sprockets vulnerable to Path Traversal
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2014-7819US | medium5.0 | — | ||
Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.htmlWEB
- https://access.redhat.com/errata/RHBA-2015:1100WEB
- https://access.redhat.com/security/cve/CVE-2014-7819WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1161527WEB
- https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqYWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan