Lucene search
HistoryMay 07, 2014 - 10:55 a.m.
CVE-2014-0130
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
6.3 Medium
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
71.1%
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Affected configurations
Node
redhatsubscription_asset_managerRangeβ€1.3.0
Node
rubyonrailsrailsMatch3.2.0
ORrubyonrailsrailsMatch3.2.0rc1
ORrubyonrailsrailsMatch3.2.0rc2
ORrubyonrailsrailsMatch3.2.1
ORrubyonrailsrailsMatch3.2.2
ORrubyonrailsrailsMatch3.2.2rc1
ORrubyonrailsrailsMatch3.2.3
ORrubyonrailsrailsMatch3.2.3rc1
ORrubyonrailsrailsMatch3.2.3rc2
ORrubyonrailsrailsMatch3.2.4
ORrubyonrailsrailsMatch3.2.4rc1
ORrubyonrailsrailsMatch3.2.5
ORrubyonrailsrailsMatch3.2.6
ORrubyonrailsrailsMatch3.2.7
ORrubyonrailsrailsMatch3.2.8
ORrubyonrailsrailsMatch3.2.9
ORrubyonrailsrailsMatch3.2.10
ORrubyonrailsrailsMatch3.2.11
ORrubyonrailsrailsMatch3.2.12
ORrubyonrailsrailsMatch3.2.13rc1
ORrubyonrailsrailsMatch3.2.13rc2
ORrubyonrailsrailsMatch3.2.15rc3
ORrubyonrailsrailsMatch3.2.16
ORrubyonrailsrailsMatch4.0.0-
ORrubyonrailsrailsMatch4.0.0beta
ORrubyonrailsrailsMatch4.0.0rc1
ORrubyonrailsrailsMatch4.0.0rc2
ORrubyonrailsrailsMatch4.0.1-
ORrubyonrailsrailsMatch4.0.1rc1
ORrubyonrailsrailsMatch4.0.1rc2
ORrubyonrailsrailsMatch4.0.1rc3
ORrubyonrailsrailsMatch4.0.1rc4
ORrubyonrailsrailsMatch4.0.2
ORrubyonrailsrailsMatch4.0.3
ORrubyonrailsrailsMatch4.0.4
ORrubyonrailsrailsMatch4.1.0-
ORrubyonrailsrailsMatch4.1.0beta1
ORrubyonrailsruby_on_railsRangeβ€3.2.17
Related
veracode
veracode
Directory Traversal When Route Globbing Configurations Are Enabled
2019-01-15 08:55:13
Cross-Site Scripting (XSS)
2019-05-02 05:02:41
Credential Disclosure Through A Brute Force Attack
2019-05-02 05:02:41
myhack58
myhack58
centos
centos
ruby193 security update
2014-05-21 17:54:02
hackerone
hackerone
New Relic: newrelic.com rails directory traversal vuln
2016-04-23 13:23:49
Ruby on Rails: Directory traversal attack in view resolver
2014-03-06 11:13:20
nessus
nessus
openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0720-1)
2014-06-13 00:00:00
openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0718-1)
2014-06-13 00:00:00
Fedora 20 : rubygem-actionpack-4.0.0-4.fc20 (2014-6098)
2014-05-25 00:00:00
cisa_kev
cisa_kev
Ruby on Rails Directory Traversal Vulnerability
2022-03-25 00:00:00
cvelist
cvelist
CVE-2014-0130
2014-05-07 10:00:00
seebug
seebug
websecuritylog
websecuritylog
securityvulns
securityvulns
cve
cve
CVE-2014-0130
2014-05-07 10:55:04
redhat
redhat
(RHSA-2014:0510) Moderate: ruby193-rubygem-actionpack security update
2014-05-15 00:00:00
(RHSA-2014:0816) Important: cfme security, bug fix, and enhancement update
2014-06-30 00:00:00
(RHSA-2014:1863) Important: Subscription Asset Manager 1.4 security update
2014-11-17 00:00:00
prion
prion
Directory traversal
2014-05-07 10:55:00
ubuntucve
ubuntucve
CVE-2014-0130
2014-05-07 00:00:00
github
github
actionpack Path Traversal vulnerability
2017-10-24 18:33:36
attackerkb
attackerkb
CVE-2014-0130
2014-05-07 00:00:00
osv
osv
actionpack Path Traversal vulnerability
2017-10-24 18:33:36
ruby-actionpack-3.2 - security update
2014-05-16 00:00:00
mageia
mageia
Updated ruby-actionpack packages fix security issues
2014-07-26 17:09:43
openvas
openvas
Mageia: Security Advisory (MGASA-2014-0303)
2022-01-28 00:00:00
Debian Security Advisory DSA 2929-1 (ruby-actionpack-3.2 - security update)
2014-05-16 00:00:00
Debian: Security Advisory (DSA-2929-1)
2014-05-15 00:00:00
debian
debian
[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update
2014-05-16 08:15:07
fedora
fedora
[SECURITY] Fedora 20 Update: rubygem-actionpack-4.0.0-4.fc20
2014-05-23 18:56:34
[SECURITY] Fedora 20 Update: rubygem-actionpack-4.0.0-5.fc20
2015-03-05 12:31:58
[SECURITY] Fedora 19 Update: rubygem-actionpack-3.2.13-6.fc19
2014-05-23 18:58:55
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
6.3 Medium
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
71.1%
Related for NVD:CVE-2014-0130