CVE-2018-3760 Sprockets path traversal leads to information leak
HighCVSS 7.5
EPSS 26.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems sprockets(RubyGems) | < 2.12.5 | 2.12.5 |
| rubygems sprockets(RubyGems) | >= 3.0.0, < 3.7.2 | 3.7.2 |
| rubygems sprockets(RubyGems) | >= 4.0.0.beta1, <= 4.0.0.beta7 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.0.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.0.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.0.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.0.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.1.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.2.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.3.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.3.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.3.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.3.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.3.4 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.3.5 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.4.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.4.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.5.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.5.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.5.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.6.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.6.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.6.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.6.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 3.7.0 | No fix listed |
Show 90 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems sprockets(RubyGems) | = 3.7.1 | No fix listed |
| rubygems sprockets(RubyGems) | >= 4.0.0.beta1, < 4.0.0.beta8 | 4.0.0.beta8 |
| rubygems sprockets(RubyGems) | = 4.0.0.beta1 | No fix listed |
| rubygems sprockets(RubyGems) | = 4.0.0.beta2 | No fix listed |
| rubygems sprockets(RubyGems) | = 4.0.0.beta3 | No fix listed |
| rubygems sprockets(RubyGems) | = 4.0.0.beta4 | No fix listed |
| rubygems sprockets(RubyGems) | = 4.0.0.beta5 | No fix listed |
| rubygems sprockets(RubyGems) | = 4.0.0.beta6 | No fix listed |
| rubygems sprockets(RubyGems) | = 4.0.0.beta7 | No fix listed |
| rubygems sprockets(RubyGems) | = 0.9.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 0.9.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 1.0.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 1.0.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 1.0.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.4 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.0.5 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.0.beta | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.1.4 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.10.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.10.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.10.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.11.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.11.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.12.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.12.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.12.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.12.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.12.4 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.2.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.2.0.beta | No fix listed |
| rubygems sprockets(RubyGems) | = 2.2.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.2.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.2.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.3.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.3.0.beta | No fix listed |
| rubygems sprockets(RubyGems) | = 2.3.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.3.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.3.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.4 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.5 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.4.6 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.5.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.5.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.6.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.6.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.7.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.7.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.8.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.8.1 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.8.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.8.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.9.0 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.9.2 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.9.3 | No fix listed |
| rubygems sprockets(RubyGems) | = 2.9.4 | No fix listed |
| debian/ruby-sprockets(Debian:12) | < 3.7.0-1.1 | 3.7.0-1.1 |
| debian/ruby-sprockets(Debian:13) | < 3.7.0-1.1 | 3.7.0-1.1 |
| debian/ruby-sprockets(Debian:14) | < 3.7.0-1.1 | 3.7.0-1.1 |
| redhat cloudforms | = 4.5 | No fix listed |
| redhat cloudforms | = 4.6 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 6.7 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux | = 7.3 | No fix listed |
| redhat enterprise linux | = 7.4 | No fix listed |
| redhat enterprise linux | = 7.5 | No fix listed |
| redhat enterprise linux | = 7.6 | No fix listed |
| sprockets project sprockets | >= 2.0.0, <= 2.12.4 | No fix listed |
| sprockets project sprockets | >= 3.0.0, <= 3.7.1 | No fix listed |
| sprockets project sprockets | = 4.0.0-beta1 | No fix listed |
| sprockets project sprockets | = 4.0.0-beta2 | No fix listed |
| sprockets project sprockets | = 4.0.0-beta3 | No fix listed |
| sprockets project sprockets | = 4.0.0-beta4 | No fix listed |
| sprockets project sprockets | = 4.0.0-beta5 | No fix listed |
| sprockets project sprockets | = 4.0.0-beta6 | No fix listed |
| sprockets project sprockets | = 4.0.0-beta7 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| HackerOne Sprockets | = 4.0.0.beta8, 3.7.2, 2.12.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2018:2244 third-party-advisory vendor-advisory
- RHSA-2018:2245 third-party-advisory vendor-advisory
- RHSA-2018:2561 third-party-advisory vendor-advisory
- RHSA-2018:2745 third-party-advisory vendor-advisory
- groups.google.com patch third-party-advisory
- DSA-4242 third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com
- github.com product
- Debian Security Tracker CVE-2018-3760 vendor-advisory
- github.com broken-link
- bugs.debian.org issue-tracking