CVE-2016-0752 Directory traversal vulnerability in Action View in Ruby on Rails
HighCVSS 7.5
EPSS 95.5%
CISA KEV
added 2022-03-25 · due 2022-04-15
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-25
- Due date (FCEB)
- 2022-04-15
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionview(RubyGems) | >= 4.0.0, < 4.1.14.1 | 4.1.14.1 |
| rubygems actionview(RubyGems) | = 4.1.0 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.0.beta1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.0.beta2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.0.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.0.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10.rc3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10.rc4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.11 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.12 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.12.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.13 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.13.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.14 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.14.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.14.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.2.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.2.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.2.rc3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.3 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionview(RubyGems) | = 4.1.4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.5 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.6 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.6.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.6.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.7 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.7.1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.8 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.9 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.9.rc1 | No fix listed |
| rubygems actionview(RubyGems) | >= 4.2.0, < 4.2.5.1 | 4.2.5.1 |
| rubygems actionview(RubyGems) | = 4.2.0 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1.rc3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1.rc4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.3.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.4.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.5 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.5.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.5.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | >= 4.0.0, < 4.1.14.1 | 4.1.14.1 |
| rubygems actionpack(RubyGems) | = 4.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.10.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.10.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.11.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.13 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.13.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.6.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.6.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.6.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.0.beta1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.0.beta2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.0.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.10.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.10.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.10.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.10.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.12.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.13 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.13.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.14 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.14.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.14.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.2.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.2.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.2.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.6.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.6.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.7.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.1.9.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | >= 4.2.0, < 4.2.5.1 | 4.2.5.1 |
| rubygems actionpack(RubyGems) | = 4.2.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.3.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.5.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | < 3.2.22.1 | 3.2.22.1 |
| rubygems actionpack(RubyGems) | = 0.9.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 0.9.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.10.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.10.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.2.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.3.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.3.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.4.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.5.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.5.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.6.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.7.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.8.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.8.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.9.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.9.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.2.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.2.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.14 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.15 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.16 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.17 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.18 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.8.pre1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.9.pre | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.rc | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.10.rc1 | No fix listed |
References
- Debian Security Tracker CVE-2016-0752 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- github.com exploit
- github.com exploit
- groups.google.com
- [ruby-security-ann] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action View broken-link mailing-list
- web.archive.org
- web.archive.org
- web.archive.org
- www.cisa.gov government-resource us-government-resource
- 40561 exploit third-party-advisory vdb-entry
- FEDORA-2016-fa0dec2360 permissions-required vendor-advisory
- FEDORA-2016-97002ad37b permissions-required vendor-advisory
- SUSE-SU-2016:1146 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0363 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0372 mailing-list third-party-advisory vendor-advisory
- RHSA-2016:0296 third-party-advisory vendor-advisory
- DSA-3464 mailing-list third-party-advisory vendor-advisory
- [oss-security] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action View exploit mailing-list
- 81801 broken-link third-party-advisory vdb-entry
- 1034816 broken-link third-party-advisory vdb-entry