Description

The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.

Remediation

References

CVE-2012-4522

Related Vulnerabilities

MySQL CVE-2016-0666 Vulnerability (CVE-2016-0666)

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2014-7137)

SugarCRM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-17313)

WordPress Plugin WonderPlugin Audio Player Multiple Vulnerabilities (2.0)

Apache Tomcat CVE-2020-0822 Vulnerability (CVE-2020-0822)

Severity

Medium

Classification

CVE-2012-4522 CWE-264

Tags

Missing Update Known Vulnerabilities