Lucene search

RubySecRUBY:RACK-2013-0262-89938

HistoryFeb 06, 2013 - 8:00 p.m.

CVE-2013-0262 rubygem-rack: Path sanitization information disclosure

2013-02-0620:00:00

RubySec

rubysec.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.005 Low

EPSS

Percentile

76.5%

JSON

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before
1.4.5 allows attackers to access arbitrary files outside the intended root directory
via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability
that is remotely exploitable, aka “symlink path traversals.”

CPENameOperatorVersion
rackle1.4.4
rackge1.5.0
racklt1.5.2

Name	Operator	Version
rack	le	1.4.4
rack	ge	1.5.0
rack	lt	1.5.2

References

nvd.nist.gov/vuln/detail/CVE-2013-0262

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.005 Low

EPSS

Percentile

76.5%

JSON

Related for RUBY:RACK-2013-0262-89938