2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2014-0130" ,
"sourceIdentifier" : "secalert@redhat.com" ,
"published" : "2014-05-07T10:55:04.133" ,
"lastModified" : "2023-02-13T00:32:38.267" ,
2024-07-14 02:06:08 +00:00
"vulnStatus" : "Undergoing Analysis" ,
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"cisaExploitAdd" : "2022-03-25" ,
"cisaActionDue" : "2022-04-15" ,
"cisaRequiredAction" : "Apply updates per vendor instructions." ,
"cisaVulnerabilityName" : "Ruby on Rails Directory Traversal Vulnerability" ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request."
} ,
{
"lang" : "es" ,
"value" : "Vulnerabilidad de salto de directorio en actionpack/lib/abstract_controller/base.rb en la implementaci\u00f3n implicit-render en Ruby on Rails anterior a 3.2.18, 4.0.x anterior a 4.0.5 y 4.1.x anterior a 4.1.1, cuando ciertas configuraciones de coincidencia de patrones en rutas basadas en caracteres comod\u00edn (globbing) est\u00e1n habilitadas, permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de una solicitud manipulada."
}
] ,
"metrics" : {
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "MEDIUM" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "PARTIAL" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 4.3
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 8.6 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-22"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:redhat:subscription_asset_manager:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "1.3.0" ,
"matchCriteriaId" : "C16B5251-FF39-4CB3-820E-0796B70BAD5A"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2816C02C-E13E-4367-91F3-14756A90EC9E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*" ,
"matchCriteriaId" : "1AE674DE-65DB-437E-A034-A2EE5C584B33"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "32EB2C3F-0F24-43DB-988E-BD2973598F71"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "EB32713D-FE64-445E-872E-B4678C243AB1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "89C618DC-38BC-4484-8C41-BC38B7EB636B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*" ,
"matchCriteriaId" : "FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "AC2616BD-A4E8-42F3-BB5A-7517DC4EDA3D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "0E376782-98B0-4766-B6FC-67E032A00C62"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "96D08DC1-14E9-4DB9-BC95-3F73B454FBC4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F365C9E5-27DC-46C3-AFE4-4876EC7B352B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "6F0016A6-0ED6-443D-B969-CB1226D8E28C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E69470EA-5EBC-4FB9-A722-5B61C70C1140"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B13A8EBB-4211-4AB1-8872-244EEEE20ABD"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C9AB2152-DED8-4CFD-B915-94A9F56FDD05"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C630AB60-DBAF-421E-B663-492BAE8A180F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0F41CCF8-14EB-4327-A675-83BFDBB53196"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "FE65D701-AA6E-48E4-B62B-C22DEE863503"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*" ,
"matchCriteriaId" : "17B1E475-C873-4561-9348-027721C08D79"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*" ,
"matchCriteriaId" : "6646610D-279B-4AEC-B445-981E7784EE5B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "50F51980-EAD9-4E4D-A2E7-1FACFA80AAB0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "2E950E33-CD03-45F5-83F9-F106060B4A8B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*" ,
"matchCriteriaId" : "547C62C8-4B3E-431B-AA73-5C42ED884671"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "4CDAD329-35F7-4C82-8019-A0CF6D069059"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*" ,
"matchCriteriaId" : "56D3858B-0FEE-4E8D-83C2-68AF0431F478"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "254884EE-EBA4-45D0-9704-B5CB22569668"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "35FC7015-267C-403B-A23D-EDA6223D2104"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*" ,
"matchCriteriaId" : "5C913A56-959D-44F1-BD89-D246C66D1F09"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*" ,
"matchCriteriaId" : "5D5BA926-38EE-47BE-9D16-FDCF360A503B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*" ,
"matchCriteriaId" : "18EA25F1-279A-4F1A-883D-C064369F592E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "FD794856-6F30-4ABF-8AE4-720BB75E6F89"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B4199B8B-A6F9-4BFD-8D27-0E663D8C579D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F11E76A3-FA5B-4038-AB52-3D7D5E54D8A2"
} ,
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "C310EA3E-399A-48FD-8DE9-6950E328CF23"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*" ,
"matchCriteriaId" : "293B2998-5169-4960-BEC4-21DAC837E32B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "3.2.17" ,
"matchCriteriaId" : "52BC8E42-08EA-4326-BCD8-C9549B22647E"
}
]
}
]
}
] ,
"references" : [
{
"url" : "http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Technical Description"
]
} ,
{
"url" : "http://rhn.redhat.com/errata/RHSA-2014-1863.html" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.securityfocus.com/bid/67244" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Third Party Advisory" ,
"VDB Entry"
]
} ,
{
"url" : "https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Third Party Advisory"
]
}
]
}
