CVE-2013-4413: Path Traversal
Directory traversal vulnerability in controller/concerns/renderredirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step.
Other sources
The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in controller/concerns/renderredirect.rb. An attacker can send a specially-crafted URL request containing %2E%2E%2F directory traversal sequences to read arbitrary files on the system.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4413?
CVE-2013-4413 is classified as a critical vulnerability due to its potential for remote file access.
How do I fix CVE-2013-4413?
To fix CVE-2013-4413, upgrade the Wicked gem to version 1.0.1 or later.
What versions of Wicked are affected by CVE-2013-4413?
CVE-2013-4413 affects Wicked gem versions prior to 1.0.1, including 0.0.1 to 0.6.1.
What type of vulnerability is CVE-2013-4413?
CVE-2013-4413 is a directory traversal vulnerability that allows attackers to read arbitrary files.
Can CVE-2013-4413 lead to sensitive data exposure?
Yes, exploitation of CVE-2013-4413 can lead to the exposure of sensitive files and data.