CVE-2008-1891: Path Traversal
Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1891?
CVE-2008-1891 is considered a critical vulnerability due to its potential to allow unauthorized reading of sensitive files.
How do I fix CVE-2008-1891?
To fix CVE-2008-1891, upgrade Ruby to version 1.8.5-p231, 1.8.6-p230, 1.8.7-p22, or any version above 1.9.0-2.
Which versions of Ruby are affected by CVE-2008-1891?
CVE-2008-1891 affects Ruby versions 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2.
What types of files can be exposed by CVE-2008-1891?
CVE-2008-1891 can potentially expose arbitrary CGI files to remote attackers due to the directory traversal vulnerability.
Does CVE-2008-1891 affect systems using NTFS or FAT filesystems?
Yes, CVE-2008-1891 notably affects systems utilizing NTFS or FAT filesystems, allowing exploitative access to files.