CVE-2016-0752

Ruby on Rails Directory Traversal Vulnerability

Rails

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

16. Feb 2016

Ausgewertete Quellen

• Debian
  http://www.debian.org/security/2016/dsa-3464
• Red Hat
  http://rhn.redhat.com/errata/RHSA-2016-0296.html
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
• Hinweis
  http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
• Hinweis
  http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
• Hinweis
  http://www.securityfocus.com/bid/81801
• Hinweis
  http://www.securitytracker.com/id/1034816
• Hinweis
  https://www.exploit-db.com/exploits/40561/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752
• CISA
  Ruby on Rails Directory Traversal Vulnerability
• NVD
  CVE-2016-0752