CVE-2013-0262: Path Traversal
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATHINFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Other sources
James Tucker (raggi) reports:
CVE: CVE-2013-0262 Software: Rack (rack.github.com) Type of vulnerability: Information Disclosure Vulnerable code: https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56 Patch: https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30 Versions affected: All versions after 1.4.0 Versions fixed: 1.4.5, 1.5.2 Reporter: Ben Murphy
— Red Hat
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATHINFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0262?
CVE-2013-0262 is considered a critical vulnerability due to its potential for remote exploitation that allows arbitrary file access.
How do I fix CVE-2013-0262?
To fix CVE-2013-0262, upgrade Rack to version 1.4.5 or 1.5.2 or later.
Which versions of Rack are affected by CVE-2013-0262?
Versions of Rack 1.4.0 through 1.4.4 and 1.5.0 through 1.5.1 are affected by CVE-2013-0262.
What types of attacks does CVE-2013-0262 enable?
CVE-2013-0262 enables directory traversal attacks that could allow unauthorized access to sensitive files outside the intended root directory.
Is CVE-2013-0262 a local or remote vulnerability?
CVE-2013-0262 is a remote vulnerability that can be exploited over the network.