Kurz gesagt
- CVE-2013-0262 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in rack, rack (rack project).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.9%, höher als bei 87.1% aller Schwachstellen.
- Abhilfe: auf 1.4.5, 1.5.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| rack RubyGems | ≥ 1.4.0, < 1.4.5≥ 1.5.0, < 1.5.2
| 1.4.51.5.2
|
| rack | = 1.4.0= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.5.0= 1.5.1
| No fix yet |
Description
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
NVD description
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free