Skip to content

actionpack vulnerable to Path Traversal

Moderate severity GitHub Reviewed Published Oct 24, 2017 to the GitHub Advisory Database • Updated Aug 25, 2023

Package

bundler actionpack (RubyGems)

Affected versions

>= 3.0.0, < 3.2.20
>= 4.0.0, < 4.0.11
>= 4.1.0, < 4.1.7
>= 4.2.0.beta1, < 4.2.0.beta3

Patched versions

3.2.20
4.0.11
4.1.7
4.2.0.beta3

Description

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

References

Published by the National Vulnerability Database Nov 8, 2014
Published to the GitHub Advisory Database Oct 24, 2017
Reviewed Jun 16, 2020
Last updated Aug 25, 2023

Severity

Moderate

EPSS score

0.455%
(76th percentile)

Weaknesses

CVE ID

CVE-2014-7818

GHSA ID

GHSA-29gr-w57f-rpfw

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.