CVE-2014-7819 sprockets vulnerable to Path Traversal
MediumCVSS 5.0
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems sprockets(RubyGems) | < 2.0.5 | 2.0.5 |
| rubygems sprockets(RubyGems) | >= 2.1.0, < 2.1.4 | 2.1.4 |
| rubygems sprockets(RubyGems) | >= 2.2.0, < 2.2.3 | 2.2.3 |
| rubygems sprockets(RubyGems) | >= 2.3.0, < 2.3.3 | 2.3.3 |
| rubygems sprockets(RubyGems) | >= 2.4.0, < 2.4.6 | 2.4.6 |
| rubygems sprockets(RubyGems) | >= 2.5.0, < 2.5.1 | 2.5.1 |
| rubygems sprockets(RubyGems) | >= 2.6.0, < 2.7.1 | 2.7.1 |
| rubygems sprockets(RubyGems) | >= 2.8.0, < 2.8.3 | 2.8.3 |
| rubygems sprockets(RubyGems) | >= 2.9.0, < 2.9.4 | 2.9.4 |
| rubygems sprockets(RubyGems) | >= 2.10.0, < 2.10.2 | 2.10.2 |
| rubygems sprockets(RubyGems) | >= 2.11.0, < 2.11.3 | 2.11.3 |
| rubygems sprockets(RubyGems) | >= 2.12.0, < 2.12.3 | 2.12.3 |
| rubygems sprockets(RubyGems) | = 0.9.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 0.9.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 1.0.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 1.0.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 1.0.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.4 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.2 | No fix listed |
Show 47 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems sprockets(RubyGems) | = 2.1.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.2.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.2.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.2.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.3.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.3.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.3.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.4 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.5 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.5.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.6.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.6.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.7.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.8.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.8.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.8.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.9.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.9.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.9.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.10.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.10.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.11.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.12.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.12.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.12.2 | No fix listed |
| debian/ruby-sprockets(Debian:12) | < 2.12.3-1 | 2.12.3-1 |
| debian/ruby-sprockets(Debian:13) | < 2.12.3-1 | 2.12.3-1 |
| debian/ruby-sprockets(Debian:14) | < 2.12.3-1 | 2.12.3-1 |
| sprockets project sprockets | >= 2.0.0, < 2.0.5 | 2.0.5 |
| sprockets project sprockets | >= 2.1.0, < 2.1.4 | 2.1.4 |
| sprockets project sprockets | >= 2.2.0, < 2.2.3 | 2.2.3 |
| sprockets project sprockets | >= 2.3.0, < 2.3.3 | 2.3.3 |
| sprockets project sprockets | >= 2.4.0, < 2.4.6 | 2.4.6 |
| sprockets project sprockets | >= 2.5.0, < 2.5.1 | 2.5.1 |
| sprockets project sprockets | >= 2.7.0, < 2.7.1 | 2.7.1 |
| sprockets project sprockets | >= 2.8.0, < 2.8.3 | 2.8.3 |
| sprockets project sprockets | >= 2.9.0, < 2.9.4 | 2.9.4 |
| sprockets project sprockets | >= 2.10.0, < 2.10.2 | 2.10.2 |
| sprockets project sprockets | >= 2.11.0, < 2.11.3 | 2.11.3 |
| sprockets project sprockets | >= 2.12.0, < 2.12.3 | 2.12.3 |
| sprockets project sprockets | = 2.6.0 | No fix listed |
| sprockets project sprockets | = 3.0.0-beta1 | No fix listed |
| sprockets project sprockets | = 3.0.0-beta2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [rubyonrails-security] 20141030 [AMENDED] [CVE-2014-7819] Arbitrary file existence disclosure in Sprockets mailing-list third-party-advisory
- [rubyonrails-security] 20141030 Arbitrary file existence disclosure in Sprockets (CVE-2014-7819) mailing-list third-party-advisory
- openSUSE-SU-2014:1502 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:1504 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:1513 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:1514 mailing-list third-party-advisory vendor-advisory
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- groups.google.com
- github.com
- Debian Security Tracker CVE-2014-7819 vendor-advisory