| Package | Affected versions | Patched versions |
|---|---|---|
| wicked | < 1.0.1 | 1.0.1 |
| wicked | = 0.0.1= 0.0.2= 0.1.0= 0.1.1= 0.1.2= 0.1.3= 0.1.4= 0.1.5= 0.1.6= 0.2.0= 0.3.0= 0.3.1= 0.3.2= 0.3.3= 0.3.4= 0.4.0= 0.5.0= 0.6.0= 0.6.1≤ 1.0.0 |
The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in controller/concerns/render_redirect.rb. An attacker can send a specially-crafted URL request containing %2E%2E%2F directory traversal sequences to read arbitrary files on the system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free