Skip to content

Directory traversal vulnerability in actionpack

Moderate severity GitHub Reviewed Published Oct 24, 2017 to the GitHub Advisory Database • Updated Aug 25, 2023

Package

bundler actionpack (RubyGems)

Affected versions

>= 3.0.0, < 3.2.21
>= 4.0.0, < 4.0.12
>= 4.1.0, < 4.1.8
>= 4.2.0.beta1, < 4.2.0.beta4

Patched versions

3.2.21
4.0.12
4.1.8
4.2.0.beta4

Description

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

References

Published by the National Vulnerability Database Nov 18, 2014
Published to the GitHub Advisory Database Oct 24, 2017
Reviewed Jun 17, 2020
Last updated Aug 25, 2023

Severity

Moderate

EPSS score

0.525%
(77th percentile)

Weaknesses

CVE ID

CVE-2014-7829

GHSA ID

GHSA-h56m-vwxc-3qpw

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.