GitHub Advisoryadvisory · RubyGems

GHSA-5f9h-9pjv-v6j7 Directory traversal in Rack::Directory app bundled with Rack

HIGH Published 2020-07-06 Modified 2022-05-26 Official page ↗
Aliases
CVE-2020-8161
Ecosystem
RubyGems
Packages
rack
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-548
Reviewed
2020-07-06

Affected packages

• RubyGems rack: < 2.1.3 → fixed in 2.1.3

Description

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

Related

Alias · CVE (1)

  • CVE-2020-8161 A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-548 Exposure of Information Through Directory Listing weakness

References