CVE-2019-5418

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.985 · 100 %ileexploit · functionalDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 14 exploits · functional

Likely / severe?

98.5% (100th) EPSS

CVSS 5 · medium

Is it mine?

115 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-07-07remediate by 2025-07-28

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-27

Rails Ruby on Rails Path Traversal Vulnerability

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedansible-tower-0:3.4.3-1.el7at.src as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedansible-tower-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedansible-tower-server-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedansible-tower-setup-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedansible-tower-ui-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-appliance-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-appliance-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-gemset-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-gemset-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedcfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:0796
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1147
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedrh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:1149
Fixedcfme-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-appliance-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-appliance-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-gemset-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-gemset-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289
Fixedcfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
https://access.redhat.com/errata/RHSA-2019:1289

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–8.1

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.08.1highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200USCWE-200USCWE-22USCWE-22US

exploits (14)

Public proof-of-concept and weaponised exploit code.

auxiliary/gather/rails_doubletap_file_readRuby On Rails File Content Disclosure ('doubletap')functional · metasploit
EDB-46585Rails 5.2.1 - Arbitrary File Content DisclosurePoC · exploit_db
5t1ck/rails-doubletap-pyAutomated Ruby on Rails doubletap RCE (CVE-2019-5418 + CVE-2019-5420) in pure Python, using the ERB#def_module gadget for modern Ruby.PoC · poc_in_github
Bad3r/RailroadBandita demo for Ruby on Rails CVE-2019-5418PoC · poc_in_github
CyberCTF/vulhub-rails-cve-2019-5418Vulhub rails/CVE-2019-5418: Ruby on Rails Accept Header File Disclosure (CVE-2019-5418), run with IsoloomPoC · poc_in_github
brompwnie/CVE-2019-5418-ScannerA multi-threaded Golang scanner to identify Ruby endpoints vulnerable to CVE-2019-5418PoC · poc_in_github

affected products (115)

Products and version ranges known to be affected.

Open Source Ruby on Rails <4.2.11.1all versionscert_bundDE
Open Source Ruby on Rails <5.0.7.2all versionscert_bundDE
Open Source Ruby on Rails <5.1.6.2all versionscert_bundDE
Open Source Ruby on Rails <5.2.2.1all versionscert_bundDE
Open Source Ruby on Rails <6.0.0.beta3all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Open Source Ruby on Rails< 4.2.11.1cert_bundDE
Open Source Ruby on Rails< 5.0.7.2cert_bundDE
Open Source Ruby on Rails< 5.1.6.2cert_bundDE
Open Source Ruby on Rails< 5.2.2.1cert_bundDE
Open Source Ruby on Rails< 6.0.0.beta3cert_bundDE
rails https://github.com/rails/rails≤ 4.2.11.1enisa_euvdEU
rails https://github.com/rails/rails≤ 5.0.7.2enisa_euvdEU
rails https://github.com/rails/rails≤ 5.2.2.1enisa_euvdEU
rails https://github.com/rails/rails≤ 5.1.6.2enisa_euvdEU
Fedora Project Fedora≤ 30fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.0fstec_bduRU
Rails Core Team Ruby on Rails≤ 4.2.11.1fstec_bduRU

showing 20 of 115

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2019:0796Red Hat Security Advisory: CloudForms 4.7.3 security, bug fix and enhancement update2019-04-23csaf · redhat_csafUS
An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:1147Red Hat Security Advisory: rh-ror50-rubygem-actionpack security update2019-05-13csaf · redhat_csafUS
An update for rh-ror50-rubygem-actionpack is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:1149Red Hat Security Advisory: rh-ror42-rubygem-actionpack security update2019-05-13csaf · redhat_csafUS
An update for rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:1289Red Hat Security Advisory: CloudForms 4.6.9 security, bug fix and enhancement update2019-05-29csaf · redhat_csafUS
An update is now available for CloudForms Management Engine 5.9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2025-1467Ruby on Rails: Mehrere SchwachstellenDeutsch2019-03-13csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand hervorzurufen oder beliebigen Programmcode auszuführen.
GHSA-86g5-2wh3-gc9jPath Traversal in Action View2019-03-13ghsa · osvUS
# File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this: ``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end ``` Rendering templates as opposed to files is not impacted by this vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this: ``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end ``` In summary, impacted calls to `render` look like this: ``` render file: "#{Rails.root}/some/file" ``` The vulnerability can be mitigated by changing to this: ``` render file: "#{Rails.root}/some/file", formats: [:html] ``` Other calls to `render` are not impacted. Alternatively, the following monkey patch can be applied in an initializer: ``` ruby $ cat config/initializers/formats_filter.rb # frozen_string_literal: true ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "*/*" end end end) ``` Credits ------- Thanks to John Hawthorn <john@hawthorn.email> of GitHub

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund redhat_csaf osv NVD CVE.org MITRE

published 2019-03-27modified 2026-06-17

references (51)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan