GitHub Advisoryadvisory · RubyGems

GHSA-cj92-c4fj-w9c5 Mail Gem Path Traversal vulnerability

MEDIUM Published 2017-10-24 Modified 2023-09-05 Official page ↗
Aliases
CVE-2012-2139
Ecosystem
RubyGems
Packages
mail
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• RubyGems mail: < 2.4.4 → fixed in 2.4.4

Description

Directory traversal vulnerability in `lib/mail/network/delivery_methods/file_delivery.rb` in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a `..` (dot dot) in the to parameter.

Related

Alias · CVE (1)

  • CVE-2012-2139 Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References