GHSA-6834-r92f-jj42

Suggest an improvement
Source
https://github.com/advisories/GHSA-6834-r92f-jj42
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-6834-r92f-jj42/GHSA-6834-r92f-jj42.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6834-r92f-jj42
Withdrawn
2020-06-16T21:18:20Z
Published
2018-09-17T21:55:54Z
Modified
2024-12-02T05:44:16Z
Summary
Moderate severity vulnerability that affects actionview
Details

Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:18:20Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems / actionview

Package

Name
actionview
Purl
pkg:gem/actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Fixed
4.1.14.1

Affected versions

4.*
4.1.0
4.1.1
4.1.2.rc1
4.1.2.rc2
4.1.2.rc3
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6.rc1
4.1.6.rc2
4.1.6
4.1.7
4.1.7.1
4.1.8
4.1.9.rc1
4.1.9
4.1.10.rc1
4.1.10.rc2
4.1.10.rc3
4.1.10.rc4
4.1.10
4.1.11
4.1.12.rc1
4.1.12
4.1.13.rc1
4.1.13
4.1.14.rc1
4.1.14.rc2
4.1.14

Database specific

last_known_affected_version_range 
"<= 4.1.14.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-6834-r92f-jj42/GHSA-6834-r92f-jj42.json"

RubyGems / actionview

Package

Name
actionview
Purl
pkg:gem/actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.2.5.1

Affected versions

4.*
4.2.0
4.2.1.rc1
4.2.1.rc2
4.2.1.rc3
4.2.1.rc4
4.2.1
4.2.2
4.2.3.rc1
4.2.3
4.2.4.rc1
4.2.4
4.2.5.rc1
4.2.5.rc2
4.2.5

Database specific

last_known_affected_version_range 
"<= 4.2.5.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-6834-r92f-jj42/GHSA-6834-r92f-jj42.json"