CVE-2019-5418

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 98,5%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada rubyonrails rails, debian linux +4 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 7 Juli 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Rincian

Terbit di NVD

27 Maret 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

98,5% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Rails Ruby on Rails Path Traversal Vulnerability

Masuk KEV

7 Juli 2025

Tenggat CISA

28 Juli 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ broken link · patch · advisory vendor
• https://web.archive.org/web/20190313201629/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have... patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2019/03/22/1 mailing list · mitigasi · patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5418 pemerintah AS
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html mailing list · advisory pihak ketiga
• http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html exploit · advisory pihak ketiga · vdb entry
• https://access.redhat.com/errata/RHSA-2019:0796 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:1147 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:1149 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:1289 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T4... advisory pihak ketiga
• https://www.exploit-db.com/exploits/46585/ exploit · advisory pihak ketiga · vdb entry
• https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q permissions required