Directory traversal

2014-05-0710:55:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

70.3%

JSON

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

CPENameOperatorVersion
subscription_asset_managerle1.3.0
railseq4.0.0
railseq4.0.1
railseq4.0.2
railseq4.1.0 beta1
railseq3.2.0 rc1
railseq3.2.0 rc2
railseq3.2.0
railseq3.2.7
railseq3.2.8

Name	Operator	Version
subscription_asset_manager	le	1.3.0
rails	eq	4.0.0
rails	eq	4.0.1
rails	eq	4.0.2
rails	eq	4.1.0 beta1
rails	eq	3.2.0 rc1
rails	eq	3.2.0 rc2
rails	eq	3.2.0
rails	eq	3.2.7
rails	eq	3.2.8