GHSA-33pp-3763-mrfp

Source

https://github.com/advisories/GHSA-33pp-3763-mrfp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-33pp-3763-mrfp/GHSA-33pp-3763-mrfp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-33pp-3763-mrfp

Aliases

CVE-2014-7819

Published

2017-10-24T18:33:36Z

Modified

2023-11-01T04:45:46.192959Z

Summary

sprockets vulnerable to Path Traversal

Details

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

References

Affected packages

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.5

Affected versions

0.*

0.9.0

0.9.1

1.*

1.0.0

1.0.1

1.0.2

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0

Fixed

2.1.4

Affected versions

2.*

2.1.0

2.1.1

2.1.2

2.1.3

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0

Fixed

2.2.3

Affected versions

2.*

2.2.0

2.2.1

2.2.2

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0

Fixed

2.3.3

Affected versions

2.*

2.3.0

2.3.1

2.3.2

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Fixed

2.4.6

Affected versions

2.*

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.1

Affected versions

2.*

2.5.0

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.6.0

Fixed

2.7.1

Affected versions

2.*

2.6.0

2.6.1

2.7.0

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.8.0

Fixed

2.8.3

Affected versions

2.*

2.8.0

2.8.1

2.8.2

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.9.0

Fixed

2.9.4

Affected versions

2.*

2.9.0

2.9.2

2.9.3

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.10.0

Fixed

2.10.2

Affected versions

2.*

2.10.0

2.10.1

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.11.0

Fixed

2.11.3

Affected versions

2.*

2.11.0

RubyGems / sprockets

Package

Name: sprockets
Purl: pkg:gem/sprockets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.12.0

Fixed

2.12.3

Affected versions

2.*

2.12.0

2.12.1

2.12.2