CVE-2014-0130

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published May 7, 2014
Updated: Dec 19, 2024
CWE ID 22

Summary

CVE-2014-0130 is a directory traversal vulnerability affecting the Ruby on Rails actionpack before certain versions. Specifically, the issue lies in the implicit-render implementation in base.rb, where route globbing configurations can be exploited. This allows remote attackers to read arbitrary files through carefully crafted requests. Versions of Ruby on Rails affected by this issue include those before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Ruby on Rails
  • RedHat Enterprise Linux Server
  • Red Hat Enterprise Linux 6

Affected Vendors

  • Rails Foundation
  • Red Hat

Advisories, Assessments, and Mitigations