GitHub Advisoryadvisory · RubyGems

GHSA-m7r6-43v2-49vf Mongrel vulnerable to directory traversal via double-encoded sequences

MEDIUM Published 2022-05-01 Modified 2023-09-21 Official page ↗
Aliases
CVE-2007-6612
Ecosystem
RubyGems
Packages
mongrel
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2023-09-21

Affected packages

• RubyGems mongrel: >= 1.0.4, < 1.0.5 → fixed in 1.0.5 • RubyGems mongrel: >= 1.1.0, < 1.1.3 → fixed in 1.1.3

Description

Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 (1.0.3 and prior are not affected) and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (`.%252e`).

Related

Alias · CVE (1)

  • CVE-2007-6612 Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References