CVE-2014-0130
Fixed in a distro release ExploitedEPSS 54%CVSS 7.5
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Products: redhat subscription_asset_manager, redhat enterprise_linux_server, rubyonrails rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | actionpack | 3.2.18 |
| RubyGems | actionpack | 4.0.5 |
| RubyGems | actionpack | 4.1.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 7 | ruby-actionpack-3.2 | 3.2.6-6+deb7u2 |
| Red Hat cloudforms managementengine 5 | cfme | 0:5.2.4.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-appliance | 0:5.2.4.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-debuginfo | 0:5.2.4.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-lib | 0:5.2.4.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | mingw32-cfme-host | 0:5.2.4.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-actionpack | 1:3.2.13-8.el6cf |
| Red Hat rhel software collections 1 | ruby193-rubygem-actionpack | 1:3.2.8-5.5.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-actionpack-doc | 1:3.2.8-5.5.el6 |