GHSA-xrr4-p6fq-hjg7

Suggest an improvement
Source
https://github.com/advisories/GHSA-xrr4-p6fq-hjg7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-xrr4-p6fq-hjg7/GHSA-xrr4-p6fq-hjg7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xrr4-p6fq-hjg7
Aliases
Published
2017-10-24T18:33:35Z
Modified
2024-07-16T20:21:04.151770Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Directory traversal vulnerability in Action View in Ruby on Rails
Details

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Database specific 
{
    "nvd_published_at": "2016-02-16T02:59:06Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T22:04:24Z"
}
References

Affected packages

RubyGems / actionview

Package

Name
actionview
Purl
pkg:gem/actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.1.14.1

Affected versions

4.*

4.1.0.beta1
4.1.0.beta2
4.1.0.rc1
4.1.0.rc2
4.1.0
4.1.1
4.1.2.rc1
4.1.2.rc2
4.1.2.rc3
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6.rc1
4.1.6.rc2
4.1.6
4.1.7
4.1.7.1
4.1.8
4.1.9.rc1
4.1.9
4.1.10.rc1
4.1.10.rc2
4.1.10.rc3
4.1.10.rc4
4.1.10
4.1.11
4.1.12.rc1
4.1.12
4.1.13.rc1
4.1.13
4.1.14.rc1
4.1.14.rc2
4.1.14

Database specific 

{
    "last_known_affected_version_range": "<= 4.1.14.0"
}

RubyGems / actionview

Package

Name
actionview
Purl
pkg:gem/actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.2.5.1

Affected versions

4.*

4.2.0
4.2.1.rc1
4.2.1.rc2
4.2.1.rc3
4.2.1.rc4
4.2.1
4.2.2
4.2.3.rc1
4.2.3
4.2.4.rc1
4.2.4
4.2.5.rc1
4.2.5.rc2
4.2.5

Database specific 

{
    "last_known_affected_version_range": "<= 4.2.5.0"
}

RubyGems / actionpack

Package

Name
actionpack
Purl
pkg:gem/actionpack

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.1.14.1

Affected versions

4.*

4.0.0
4.0.1.rc1
4.0.1.rc2
4.0.1.rc3
4.0.1.rc4
4.0.1
4.0.2
4.0.3
4.0.4.rc1
4.0.4
4.0.5
4.0.6.rc1
4.0.6.rc2
4.0.6.rc3
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10.rc1
4.0.10.rc2
4.0.10
4.0.11
4.0.11.1
4.0.12
4.0.13.rc1
4.0.13
4.1.0.beta1
4.1.0.beta2
4.1.0.rc1
4.1.0.rc2
4.1.0
4.1.1
4.1.2.rc1
4.1.2.rc2
4.1.2.rc3
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6.rc1
4.1.6.rc2
4.1.6
4.1.7
4.1.7.1
4.1.8
4.1.9.rc1
4.1.9
4.1.10.rc1
4.1.10.rc2
4.1.10.rc3
4.1.10.rc4
4.1.10
4.1.11
4.1.12.rc1
4.1.12
4.1.13.rc1
4.1.13
4.1.14.rc1
4.1.14.rc2
4.1.14

Database specific 

{
    "last_known_affected_version_range": "<= 4.1.14.0"
}

RubyGems / actionpack

Package

Name
actionpack
Purl
pkg:gem/actionpack

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Fixed
4.2.5.1

Affected versions

4.*

4.2.0
4.2.1.rc1
4.2.1.rc2
4.2.1.rc3
4.2.1.rc4
4.2.1
4.2.2
4.2.3.rc1
4.2.3
4.2.4.rc1
4.2.4
4.2.5.rc1
4.2.5.rc2
4.2.5

Database specific 

{
    "last_known_affected_version_range": "<= 4.2.5.0"
}

RubyGems / actionpack

Package

Name
actionpack
Purl
pkg:gem/actionpack

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.22.1

Affected versions

0.*

0.9.0
0.9.5

1.*

1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.10.1
1.10.2
1.11.0
1.11.1
1.11.2
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6

2.*

2.0.0
2.0.1
2.0.2
2.0.4
2.0.5
2.1.0
2.1.1
2.1.2
2.2.2
2.2.3
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8.pre1
2.3.8
2.3.9.pre
2.3.9
2.3.10
2.3.11
2.3.12
2.3.14
2.3.15
2.3.16
2.3.17
2.3.18

3.*

3.0.0.beta
3.0.0.beta2
3.0.0.beta3
3.0.0.beta4
3.0.0.rc
3.0.0.rc2
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4.rc1
3.0.4
3.0.5.rc1
3.0.5
3.0.6.rc1
3.0.6.rc2
3.0.6
3.0.7.rc1
3.0.7.rc2
3.0.7
3.0.8.rc1
3.0.8.rc2
3.0.8.rc4
3.0.8
3.0.9.rc1
3.0.9.rc3
3.0.9.rc4
3.0.9.rc5
3.0.9
3.0.10.rc1
3.0.10
3.0.11
3.0.12.rc1
3.0.12
3.0.13.rc1
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.20
3.1.0.beta1
3.1.0.rc1
3.1.0.rc2
3.1.0.rc3
3.1.0.rc4
3.1.0.rc5
3.1.0.rc6
3.1.0.rc8
3.1.0
3.1.1.rc1
3.1.1.rc2
3.1.1.rc3
3.1.1
3.1.2.rc1
3.1.2.rc2
3.1.2
3.1.3
3.1.4.rc1
3.1.4
3.1.5.rc1
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.2.0.rc1
3.2.0.rc2
3.2.0
3.2.1
3.2.2.rc1
3.2.2
3.2.3.rc1
3.2.3.rc2
3.2.3
3.2.4.rc1
3.2.4
3.2.5
3.2.6
3.2.7.rc1
3.2.7
3.2.8.rc1
3.2.8.rc2
3.2.8
3.2.9.rc1
3.2.9.rc2
3.2.9.rc3
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13.rc1
3.2.13.rc2
3.2.13
3.2.14.rc1
3.2.14.rc2
3.2.14
3.2.15.rc1
3.2.15.rc2
3.2.15.rc3
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.20
3.2.21
3.2.22