GitHub Advisoryadvisory · RubyGems

GHSA-85r7-w5mv-c849 Rack Vulnerable to Path Traversal

MEDIUM Published 2017-10-24 Modified 2023-08-25 Official page ↗
Aliases
CVE-2013-0262
Ecosystem
RubyGems
Packages
rack
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• RubyGems rack: >= 1.5.0, < 1.5.2 → fixed in 1.5.2 • RubyGems rack: >= 1.4.0, < 1.4.5 → fixed in 1.4.5

Description

`rack/file.rb` (`Rack::File`) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted `PATH_INFO` environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

Related

Alias · CVE (1)

  • CVE-2013-0262 rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References