Lucene search

[email protected]CVE-2014-7818

HistoryNov 08, 2014 - 11:55 a.m.

CVE-2014-7818

2014-11-0811:55:02

CWE-22

[email protected]

web.nvd.nist.gov

cve-2014-7818

nvd

vulnerability

actionpack

action_dispatch

middleware

static.rb

ruby on rails

serve_static_assets

remote attackers

file existence

application root

sequence

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.4 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

75.4%

JSON

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /…%2F sequence.

Affected configurations

NVD

Node

rubyonrailsrailsMatch3.0.0

rubyonrailsrailsMatch3.0.0beta

rubyonrailsrailsMatch3.0.0beta2

rubyonrailsrailsMatch3.0.0beta3

rubyonrailsrailsMatch3.0.0beta4

rubyonrailsrailsMatch3.0.0rc

rubyonrailsrailsMatch3.0.0rc2

rubyonrailsrailsMatch3.0.1

rubyonrailsrailsMatch3.0.1pre

rubyonrailsrailsMatch3.0.2

rubyonrailsrailsMatch3.0.2pre

rubyonrailsrailsMatch3.0.3

rubyonrailsrailsMatch3.0.4rc1

rubyonrailsrailsMatch3.0.5

rubyonrailsrailsMatch3.0.5rc1

rubyonrailsrailsMatch3.0.6

rubyonrailsrailsMatch3.0.6rc1

rubyonrailsrailsMatch3.0.6rc2

rubyonrailsrailsMatch3.0.7

rubyonrailsrailsMatch3.0.7rc1

rubyonrailsrailsMatch3.0.7rc2

rubyonrailsrailsMatch3.0.8

rubyonrailsrailsMatch3.0.8rc1

rubyonrailsrailsMatch3.0.8rc2

rubyonrailsrailsMatch3.0.8rc3

rubyonrailsrailsMatch3.0.8rc4

rubyonrailsrailsMatch3.0.9

rubyonrailsrailsMatch3.0.9rc1

rubyonrailsrailsMatch3.0.9rc2

rubyonrailsrailsMatch3.0.9rc3

rubyonrailsrailsMatch3.0.9rc4

rubyonrailsrailsMatch3.0.9rc5

rubyonrailsrailsMatch3.0.10

rubyonrailsrailsMatch3.0.10rc1

rubyonrailsrailsMatch3.0.11

rubyonrailsrailsMatch3.0.12

rubyonrailsrailsMatch3.0.12rc1

rubyonrailsrailsMatch3.0.13

rubyonrailsrailsMatch3.0.13rc1

rubyonrailsrailsMatch3.0.14

rubyonrailsrailsMatch3.0.16

rubyonrailsrailsMatch3.0.17

rubyonrailsrailsMatch3.0.18

rubyonrailsrailsMatch3.0.19

rubyonrailsrailsMatch3.0.20

rubyonrailsrailsMatch3.1.0

rubyonrailsrailsMatch3.1.0beta1

rubyonrailsrailsMatch3.1.0rc1

rubyonrailsrailsMatch3.1.0rc2

rubyonrailsrailsMatch3.1.0rc3

rubyonrailsrailsMatch3.1.0rc4

rubyonrailsrailsMatch3.1.0rc5

rubyonrailsrailsMatch3.1.0rc6

rubyonrailsrailsMatch3.1.0rc7

rubyonrailsrailsMatch3.1.0rc8

rubyonrailsrailsMatch3.1.1

rubyonrailsrailsMatch3.1.1rc1

rubyonrailsrailsMatch3.1.1rc2

rubyonrailsrailsMatch3.1.1rc3

rubyonrailsrailsMatch3.1.2

rubyonrailsrailsMatch3.1.2rc1

rubyonrailsrailsMatch3.1.2rc2

rubyonrailsrailsMatch3.1.3

rubyonrailsrailsMatch3.1.4

rubyonrailsrailsMatch3.1.4rc1

rubyonrailsrailsMatch3.1.5

rubyonrailsrailsMatch3.1.5rc1

rubyonrailsrailsMatch3.1.6

rubyonrailsrailsMatch3.1.7

rubyonrailsrailsMatch3.1.8

rubyonrailsrailsMatch3.1.9

rubyonrailsrailsMatch3.1.10

rubyonrailsrailsMatch3.2.0

rubyonrailsrailsMatch3.2.0rc1

rubyonrailsrailsMatch3.2.0rc2

rubyonrailsrailsMatch3.2.1

rubyonrailsrailsMatch3.2.2

rubyonrailsrailsMatch3.2.2rc1

rubyonrailsrailsMatch3.2.3

rubyonrailsrailsMatch3.2.3rc1

rubyonrailsrailsMatch3.2.3rc2

rubyonrailsrailsMatch3.2.4

rubyonrailsrailsMatch3.2.4rc1

rubyonrailsrailsMatch3.2.5

rubyonrailsrailsMatch3.2.6

rubyonrailsrailsMatch3.2.7

rubyonrailsrailsMatch3.2.8

rubyonrailsrailsMatch3.2.10

rubyonrailsrailsMatch3.2.11

rubyonrailsrailsMatch3.2.12

rubyonrailsrailsMatch3.2.13rc1

rubyonrailsrailsMatch3.2.13rc2

rubyonrailsrailsMatch3.2.15rc3

rubyonrailsrailsMatch3.2.16

rubyonrailsrailsMatch3.2.17

rubyonrailsrailsMatch3.2.18

rubyonrailsrailsMatch4.0.0-

rubyonrailsrailsMatch4.0.0beta

rubyonrailsrailsMatch4.0.0rc1

rubyonrailsrailsMatch4.0.0rc2

rubyonrailsrailsMatch4.0.1-

rubyonrailsrailsMatch4.0.1rc1

rubyonrailsrailsMatch4.0.1rc2

rubyonrailsrailsMatch4.0.1rc3

rubyonrailsrailsMatch4.0.1rc4

rubyonrailsrailsMatch4.0.2

rubyonrailsrailsMatch4.0.3

rubyonrailsrailsMatch4.0.4

rubyonrailsrailsMatch4.0.5

rubyonrailsrailsMatch4.0.6

rubyonrailsrailsMatch4.0.6rc1

rubyonrailsrailsMatch4.0.6rc2

rubyonrailsrailsMatch4.0.6rc3

rubyonrailsrailsMatch4.0.7

rubyonrailsrailsMatch4.0.8

rubyonrailsrailsMatch4.0.9

rubyonrailsrailsMatch4.0.10

rubyonrailsrailsMatch4.0.10rc1

rubyonrailsrailsMatch4.1.0-

rubyonrailsrailsMatch4.1.0beta1

rubyonrailsrailsMatch4.1.1

rubyonrailsrailsMatch4.1.2

rubyonrailsrailsMatch4.1.2rc1

rubyonrailsrailsMatch4.1.2rc2

rubyonrailsrailsMatch4.1.2rc3

rubyonrailsrailsMatch4.1.3

rubyonrailsrailsMatch4.1.4

rubyonrailsrailsMatch4.1.5

rubyonrailsrailsMatch4.1.6

rubyonrailsrailsMatch4.1.6rc1

rubyonrailsrailsMatch4.2.0beta1

rubyonrailsrailsMatch4.2.0beta2

rubyonrailsruby_on_railsMatch3.0.4

rubyonrailsruby_on_railsMatch3.2.19

Node

opensuseopensuseMatch12.3

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

CPENameOperatorVersion
rubyonrails:railsrubyonrails railseq3.0.0
rubyonrails:railsrubyonrails railseq3.0.1
rubyonrails:railsrubyonrails railseq3.0.2
rubyonrails:railsrubyonrails railseq3.0.3
rubyonrails:railsrubyonrails railseq3.0.4
rubyonrails:railsrubyonrails railseq3.0.5
rubyonrails:railsrubyonrails railseq3.0.6
rubyonrails:railsrubyonrails railseq3.0.7
rubyonrails:railsrubyonrails railseq3.0.8
rubyonrails:railsrubyonrails railseq3.0.9

CPE	Name	Operator	Version
rubyonrails:rails	rubyonrails rails	eq	3.0.0
rubyonrails:rails	rubyonrails rails	eq	3.0.1
rubyonrails:rails	rubyonrails rails	eq	3.0.2
rubyonrails:rails	rubyonrails rails	eq	3.0.3
rubyonrails:rails	rubyonrails rails	eq	3.0.4
rubyonrails:rails	rubyonrails rails	eq	3.0.5
rubyonrails:rails	rubyonrails rails	eq	3.0.6
rubyonrails:rails	rubyonrails rails	eq	3.0.7
rubyonrails:rails	rubyonrails rails	eq	3.0.8
rubyonrails:rails	rubyonrails rails	eq	3.0.9