In breve
- CVE-2013-0262 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda rack, rack (rack project).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.9%, superiore al 87.1% delle vulnerabilità.
- Correzione: aggiornare a 1.4.5, 1.5.2 o successiva.
| Package | Affected versions | Patched versions |
|---|
| rack RubyGems | ≥ 1.4.0, < 1.4.5≥ 1.5.0, < 1.5.2
| 1.4.51.5.2
|
| rack | = 1.4.0= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.5.0= 1.5.1
| No fix yet |
Description
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
NVD description
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free