Tempfile on Windows path traversal vulnerability
There is an unintentional directory creation vulnerability in `tmpdir` library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-28966US | high7.5 | — | ||
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/ruby/tmpdirPACKAGE
- https://github.com/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f348WEB
- https://github.com/ruby/tmpdir/pull/8WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.ymlWEB
- https://hackerone.com/reports/1131465WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-28966ADVISORY
- https://rubygems.org/gems/tmpdirWEB
- https://security.netapp.com/advisory/ntap-20210902-0004WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan