CVE-2014-0130
High · 7.5 CISA KEVCVSS
7.5
EPSS
53.7%
Published
May 7, 2014
CISA due date
Apr 15, 2022
The record
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | actionpack | 3.0.0 | 3.2.18 |
| RubyGems | actionpack | 4.0.0 | 4.0.5 |
| RubyGems | actionpack | 4.1.0 | 4.1.1 |
| Debian:7 | ruby-actionpack-3.2 | 0 | 3.2.6-6+deb7u2 |
| Mageia:4 | ruby-actionmailer | 0 | 4.0.8-1.mga4 |
| Mageia:4 | ruby-actionpack | 0 | 4.0.8-1.mga4 |
| Mageia:4 | ruby-activemodel | 0 | 4.0.8-1.mga4 |
| Mageia:4 | ruby-activerecord | 0 | 4.0.8-1.mga4 |
| Mageia:4 | ruby-activesupport | 0 | 4.0.8-1.mga4 |
| Mageia:4 | ruby-rails | 0 | 4.0.8-1.mga4 |
| Mageia:4 | ruby-railties | 0 | 4.0.8-1.mga4 |
| Red Hat:cloudforms_managementengine:5::el6 | cfme | 0 | 0:5.2.4.2-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | cfme-appliance | 0 | 0:5.2.4.2-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | cfme-debuginfo | 0 | 0:5.2.4.2-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | cfme-lib | 0 | 0:5.2.4.2-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | mingw32-cfme-host | 0 | 0:5.2.4.2-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-actionpack | 0 | 1:3.2.13-8.el6cf |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-actionpack | 0 | 1:3.2.8-5.5.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-actionpack-doc | 0 | 1:3.2.8-5.5.el6 |
| Ubuntu:16.04:LTS | rails | 0 | 2:4.2.6-1 |
| Ubuntu:18.04:LTS | rails | 0 | 2:4.2.10-0ubuntu4 |
| gem | actionpack | 3.0.0 | 3.2.18 |
| gem | actionpack | 4.0.0 | 4.0.5 |
| gem | actionpack | 4.1.0 | 4.1.1 |
| gem | rails | 0.0 | 3.2.18 |
| gem | rails | 4.0 | 4.0.5 |
| gem | rails | 4.1 | 4.1.1 |
Related vulnerabilities
- CVE-2023-28362 The redirect_to method in Rails allows provided values to contain characters which are… Also affects actionpack
- CVE-2024-54133 Action Pack is a framework for handling and responding to web requests. Also affects actionpack
- CVE-2024-47887 Action Pack is a framework for handling and responding to web requests. Also affects actionpack
- CVE-2024-41128 Action Pack is a framework for handling and responding to web requests. Also affects actionpack
- CVE-2022-22577 An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to… Also affects actionpack
- CVE-2020-8166 A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it… Also affects actionpack
- CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before… Also affects actionpack
- CVE-2016-0752 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… Also affects actionpack