GHSA-85r7-w5mv-c849

Source

https://github.com/advisories/GHSA-85r7-w5mv-c849

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-85r7-w5mv-c849/GHSA-85r7-w5mv-c849.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-85r7-w5mv-c849

Aliases

CVE-2013-0262

Published

2017-10-24T18:33:37Z

Modified

2024-11-29T05:39:58.375850Z

Summary

Rack Vulnerable to Path Traversal

Details

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

Database specific

{
    "github_reviewed_at": "2020-06-16T21:24:29Z",
    "nvd_published_at": "2013-02-08T20:55:00Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

RubyGems / rack

Package

Name: rack
Purl: pkg:gem/rack

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.5.0

Fixed

1.5.2

Affected versions

1.*

1.5.0

1.5.1

RubyGems / rack

Package

Name: rack
Purl: pkg:gem/rack

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.4.0

Fixed

1.4.5

Affected versions

1.*

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4