CVE-2014-7819
Description
Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
Risk Information
Base Score
8.6
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
EPSS Score
Exploitation Probability
0.748
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.0.5 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.1.4 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.2.3 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.3.3 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.4.6 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.5.1 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.7.1 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.8.3 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.9.4 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.10.2 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.11.3 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets 2.12.3 | Windows |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.0.5 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.1.4 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.2.3 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.3.3 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.4.6 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.5.1 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.7.1 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.8.3 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.9.4 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.10.2 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.11.3 | Linux |
| Vulnerabilities CVE-2014-7819 are fixed in Ruby-sprockets for Linux 2.12.3 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234