Rails · Ruby on Rails
CVE-2016-0752
Ruby on Rails Directory Traversal Vulnerability
Nedir
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
CISA: Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 15 Nisan 2022
- lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
- lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
- lists.fedoraproject.org/pipermail/package-announce/2016-February/1780…
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- lists.fedoraproject.org/pipermail/package-announce/2016-February/1780…
- CISA listesine eklenme
- 25 Mart 2022
- Yayımlanma
- 16 Şubat 2016
- Önem
- Yüksek 7,5 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 96% bilinen tüm açıkların en üstteki 0,1% diliminde
- Zayıflık
- CWE-22
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (12)
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
- http://www.debian.org/security/2016/dsa-3464
- http://rhn.redhat.com/errata/RHSA-2016-0296.html
- https://www.exploit-db.com/exploits/40561/
- http://www.openwall.com/lists/oss-security/2016/01/25/13
- http://www.securityfocus.com/bid/81801
- http://www.securitytracker.com/id/1034816
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
Rails için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 7 Tem 2025 | Path Traversal | Ruby on Rails | Yüksek 7,5 | 99% |
| 25 Mar 2022 | Directory Traversal | Ruby on Rails | Yüksek 7,5 | 54% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.