CVE-2016-2097
CVE-2016-2097
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
CVSS 5.3 · Media · EPSS 4,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
n/a
- Versiones
- n/a: Afectada
Sin corrección publicada
rails Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 2:4.2.5.2-1
Actualiza a 2:4.2.5.2-1
rails Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 2:4.2.5.2-1
Actualiza a 2:4.2.5.2-1
rails Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 2:4.2.5.2-1
Actualiza a 2:4.2.5.2-1
Fuentes originales
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
- http://www.debian.org/security/2016/dsa-3509
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ
- http://www.securitytracker.com/id/1035122
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
- http://www.securityfocus.com/bid/83726
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
- http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
- https://nvd.nist.gov/vuln/detail/CVE-2016-2097