Description

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Remediation

References

CVE-2014-0130

Related Vulnerabilities

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-13450)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-6291)

MyBB Improper Input Validation Vulnerability (CVE-2016-9420)

WordPress Plugin Stars Menu Cross-Site Scripting (1.0.1)

WordPress Plugin All-In-One Security (AIOS)-Security and Firewall SQL Injection (3.9.0)

Severity

Medium

Classification

CVE-2014-0130 CWE-22

Tags

Missing Update Known Vulnerabilities