Ruby on Rails Directory Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/03/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| actionpack | ≥ 3.0.0, < 3.2.18≥ 4.0.0, < 4.0.5≥ 4.1.0, < 4.1.1 | 3.2.184.0.54.1.1 |
| subscription asset manager | ≤ 1.3.0 | |
| rails | ≥ 4.0.0, < 4.0.5≥ 4.1.0, < 4.1.1< 3.2.18 | 4.0.54.1.13.2.18 |
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free