En bref
- CVE-2013-0262 est une vulnérabilité MOYENNE (CVSS 4.3) touchant rack, rack (rack project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.9%, plus élevée que 87.1% des vulnérabilités.
- Correctif : mettre à jour vers 1.4.5, 1.5.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| rack RubyGems | ≥ 1.4.0, < 1.4.5≥ 1.5.0, < 1.5.2
| 1.4.51.5.2
|
| rack | = 1.4.0= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.5.0= 1.5.1
| No fix yet |
Description
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
NVD description
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free