CVE-2014-7819

2014-11-0811:55:03

CWE-22

redhat

web.nvd.nist.gov

cve

directory traversal

sprockets

ruby on rails

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.004

Percentile

74.4%

JSON

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a …/ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Affected configurations

Nvd

Node

sprockets_projectsprocketsRange2.0.0–2.0.5

sprockets_projectsprocketsRange2.1.0–2.1.4

sprockets_projectsprocketsRange2.2.0–2.2.3

sprockets_projectsprocketsRange2.3.0–2.3.3

sprockets_projectsprocketsRange2.4.0–2.4.6

sprockets_projectsprocketsRange2.5.0–2.5.1

sprockets_projectsprocketsRange2.7.0–2.7.1

sprockets_projectsprocketsRange2.8.0–2.8.3

sprockets_projectsprocketsRange2.9.0–2.9.4

sprockets_projectsprocketsRange2.10.0–2.10.2

sprockets_projectsprocketsRange2.11.0–2.11.3

sprockets_projectsprocketsRange2.12.0–2.12.3

sprockets_projectsprocketsMatch2.6.0

sprockets_projectsprocketsMatch3.0.0beta1

sprockets_projectsprocketsMatch3.0.0beta2

VendorProductVersionCPE
sprockets_projectsprockets*cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*
sprockets_projectsprockets2.6.0cpe:2.3:a:sprockets_project:sprockets:2.6.0:*:*:*:*:*:*:*
sprockets_projectsprockets3.0.0cpe:2.3:a:sprockets_project:sprockets:3.0.0:beta1:*:*:*:*:*:*
sprockets_projectsprockets3.0.0cpe:2.3:a:sprockets_project:sprockets:3.0.0:beta2:*:*:*:*:*:*

Vendor	Product	Version	CPE
sprockets_project	sprockets	*	cpe:2.3:a:sprockets_project:sprockets::::::::
sprockets_project	sprockets	2.6.0	cpe:2.3:a:sprockets_project:sprockets:2.6.0:::::::*
sprockets_project	sprockets	3.0.0	cpe:2.3:a:sprockets_project:sprockets:3.0.0:beta1::::::
sprockets_project	sprockets	3.0.0	cpe:2.3:a:sprockets_project:sprockets:3.0.0:beta2::::::