PT-2014-8296

Name of the Vulnerable Software and Affected Versions Action Pack in Ruby on Rails versions 3.x through 3.2.20 Action Pack in Ruby on Rails versions 4.0.x through 4.0.11 Action Pack in Ruby on Rails versions 4.1.x through 4.1.7 Action Pack in Ruby on Rails versions 4.2.x through 4.2.0.beta3...

CVE-2014-7818: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...