GitHub Advisoryadvisory · RubyGems

GHSA-mg5p-95m9-rmfp Arbitrary file write in actionpack-page_caching gem

CRITICAL Published 2020-05-13 Modified 2021-07-26 Official page ↗
Aliases
CVE-2020-8159
Ecosystem
RubyGems
Packages
actionpack-page_caching
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2020-05-13

Affected packages

• RubyGems actionpack-page_caching: < 1.2.1 → fixed in 1.2.1

Description

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.

Related

Alias · CVE (1)

  • CVE-2020-8159 There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server,… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References