CVE-2014-0130

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 53,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada redhat subscription asset manager, redhat enterprise linux server +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Rincian

Terbit di NVD

7 Mei 2014

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

53,7% peluang dieksploitasi; lebih tinggi dari 98,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Ruby on Rails Directory Traversal Vulnerability

Masuk KEV

25 Maret 2022

Tenggat CISA

15 April 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130 pemerintah AS
• http://rhn.redhat.com/errata/RHSA-2014-1863.html advisory pihak ketiga
• http://www.securityfocus.com/bid/67244 broken link · advisory pihak ketiga · vdb entry
• https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ broken link · advisory pihak ketiga
• http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf broken link · deskripsi teknis