5.3

CVE-2016-2097

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version 4.0.0 Update -
Rubyonrails ≫ Rails Version 4.0.0 Update beta
Rubyonrails ≫ Rails Version 4.0.0 Update rc1
Rubyonrails ≫ Rails Version 4.0.0 Update rc2
Rubyonrails ≫ Rails Version 4.0.1 Update -
Rubyonrails ≫ Rails Version 4.0.1 Update rc1
Rubyonrails ≫ Rails Version 4.0.1 Update rc2
Rubyonrails ≫ Rails Version 4.0.1 Update rc3
Rubyonrails ≫ Rails Version 4.0.1 Update rc4
Rubyonrails ≫ Rails Version 4.0.2
Rubyonrails ≫ Rails Version 4.0.3
Rubyonrails ≫ Rails Version 4.0.4
Rubyonrails ≫ Rails Version 4.0.4 Update rc1
Rubyonrails ≫ Rails Version 4.0.5
Rubyonrails ≫ Rails Version 4.0.6
Rubyonrails ≫ Rails Version 4.0.6 Update rc1
Rubyonrails ≫ Rails Version 4.0.6 Update rc2
Rubyonrails ≫ Rails Version 4.0.6 Update rc3
Rubyonrails ≫ Rails Version 4.0.7
Rubyonrails ≫ Rails Version 4.0.8
Rubyonrails ≫ Rails Version 4.0.9
Rubyonrails ≫ Rails Version 4.0.10 Update rc1
Rubyonrails ≫ Rails Version 4.1.0 Update -
Rubyonrails ≫ Rails Version 4.1.0 Update beta1
Rubyonrails ≫ Rails Version 4.1.0 Update beta2
Rubyonrails ≫ Rails Version 4.1.0 Update rc1
Rubyonrails ≫ Rails Version 4.1.0 Update rc2
Rubyonrails ≫ Rails Version 4.1.1
Rubyonrails ≫ Rails Version 4.1.2
Rubyonrails ≫ Rails Version 4.1.2 Update rc1
Rubyonrails ≫ Rails Version 4.1.2 Update rc2
Rubyonrails ≫ Rails Version 4.1.2 Update rc3
Rubyonrails ≫ Rails Version 4.1.3
Rubyonrails ≫ Rails Version 4.1.4
Rubyonrails ≫ Rails Version 4.1.5
Rubyonrails ≫ Rails Version 4.1.6 Update rc1
Rubyonrails ≫ Rails Version 4.1.6 Update rc2
Rubyonrails ≫ Rails Version 4.1.7
Rubyonrails ≫ Rails Version 4.1.7.1
Rubyonrails ≫ Rails Version 4.1.8
Rubyonrails ≫ Rails Version 4.1.9 Update rc1
Rubyonrails ≫ Rails Version 4.1.10 Update rc1
Rubyonrails ≫ Rails Version 4.1.10 Update rc2
Rubyonrails ≫ Rails Version 4.1.10 Update rc3
Rubyonrails ≫ Rails Version 4.1.10 Update rc4
Rubyonrails ≫ Rails Version 4.1.12 Update rc1
Rubyonrails ≫ Rails Version 4.1.13 Update rc1
Rubyonrails ≫ Rails Version 4.1.14 Update rc1
Rubyonrails ≫ Rails Version 4.1.14 Update rc2
Rubyonrails ≫ Ruby On Rails Version <= 3.2.22.1
Rubyonrails ≫ Ruby On Rails Version 4.1.14.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.42% 0.901
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
Patch
Vendor Advisory
http://www.debian.org/security/2016/dsa-3509
http://www.securityfocus.com/bid/83726
http://www.securitytracker.com/id/1035122
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ