CVE-2014-7818: Path Traversal

Q: What is the severity of CVE-2014-7818?

CVE-2014-7818 is classified as a moderate severity vulnerability due to the potential for directory traversal that may expose sensitive information.

Q: How do I fix CVE-2014-7818?

To fix CVE-2014-7818, upgrade to Action Pack version 4.2.0.beta3 or later, 4.1.7, or 4.0.11.

Q: What are the affected versions for CVE-2014-7818?

CVE-2014-7818 affects Action Pack versions before 3.2.20, 4.0.11, 4.1.7, and 4.2.0.beta3.

Q: Can CVE-2014-7818 be exploited remotely?

Yes, CVE-2014-7818 allows remote attackers to exploit the vulnerability if 'serve_static_assets' is enabled.

Q: Is CVE-2014-7818 related to Ruby on Rails?

Yes, CVE-2014-7818 is a vulnerability specific to the Action Pack component of Ruby on Rails.

Published Nov 8, 2014

Updated

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Other sources

Affected Software

141 affected componentsFixes available

rubygems/actionpack>=4.2.0.beta1<4.2.0.beta3

4.2.0.beta3

rubygems/actionpack>=4.1.0<4.1.7

4.1.7

rubygems/actionpack>=4.0.0<4.0.11

4.0.11

rubygems/actionpack>=3.0.0<3.2.20

3.2.20

rubyonrails Rails=3.0.0

rubyonrails Rails=3.0.0-beta

rubyonrails Rails=3.0.0-beta2

rubyonrails Rails=3.0.0-beta3

rubyonrails Rails=3.0.0-beta4

rubyonrails Rails=3.0.0-rc

rubyonrails Rails=3.0.0-rc2

rubyonrails Rails=3.0.1

rubyonrails Rails=3.0.1-pre

rubyonrails Rails=3.0.2

rubyonrails Rails=3.0.2-pre

rubyonrails Rails=3.0.3

rubyonrails Rails=3.0.4-rc1

rubyonrails Rails=3.0.5

rubyonrails Rails=3.0.5-rc1

rubyonrails Rails=3.0.6

rubyonrails Rails=3.0.6-rc1

rubyonrails Rails=3.0.6-rc2

rubyonrails Rails=3.0.7

rubyonrails Rails=3.0.7-rc1

rubyonrails Rails=3.0.7-rc2

rubyonrails Rails=3.0.8

rubyonrails Rails=3.0.8-rc1

rubyonrails Rails=3.0.8-rc2

rubyonrails Rails=3.0.8-rc3

rubyonrails Rails=3.0.8-rc4

rubyonrails Rails=3.0.9

rubyonrails Rails=3.0.9-rc1

rubyonrails Rails=3.0.9-rc2

rubyonrails Rails=3.0.9-rc3

rubyonrails Rails=3.0.9-rc4

rubyonrails Rails=3.0.9-rc5

rubyonrails Rails=3.0.10

rubyonrails Rails=3.0.10-rc1

rubyonrails Rails=3.0.11

rubyonrails Rails=3.0.12

rubyonrails Rails=3.0.12-rc1

rubyonrails Rails=3.0.13

rubyonrails Rails=3.0.13-rc1

rubyonrails Rails=3.0.14

rubyonrails Rails=3.0.16

rubyonrails Rails=3.0.17

rubyonrails Rails=3.0.18

rubyonrails Rails=3.0.19

rubyonrails Rails=3.0.20

rubyonrails Rails=3.1.0

rubyonrails Rails=3.1.0-beta1

rubyonrails Rails=3.1.0-rc1

rubyonrails Rails=3.1.0-rc2

rubyonrails Rails=3.1.0-rc3

rubyonrails Rails=3.1.0-rc4

rubyonrails Rails=3.1.0-rc5

rubyonrails Rails=3.1.0-rc6

rubyonrails Rails=3.1.0-rc7

rubyonrails Rails=3.1.0-rc8

rubyonrails Rails=3.1.1

rubyonrails Rails=3.1.1-rc1

rubyonrails Rails=3.1.1-rc2

rubyonrails Rails=3.1.1-rc3

rubyonrails Rails=3.1.2

rubyonrails Rails=3.1.2-rc1

rubyonrails Rails=3.1.2-rc2

rubyonrails Rails=3.1.3

rubyonrails Rails=3.1.4

rubyonrails Rails=3.1.4-rc1

rubyonrails Rails=3.1.5

rubyonrails Rails=3.1.5-rc1

rubyonrails Rails=3.1.6

rubyonrails Rails=3.1.7

rubyonrails Rails=3.1.8

rubyonrails Rails=3.1.9

rubyonrails Rails=3.1.10

rubyonrails Rails=3.2.0

rubyonrails Rails=3.2.0-rc1

rubyonrails Rails=3.2.0-rc2

rubyonrails Rails=3.2.1

rubyonrails Rails=3.2.2

rubyonrails Rails=3.2.2-rc1

rubyonrails Rails=3.2.3

rubyonrails Rails=3.2.3-rc1

rubyonrails Rails=3.2.3-rc2

rubyonrails Rails=3.2.4

rubyonrails Rails=3.2.4-rc1

rubyonrails Rails=3.2.5

rubyonrails Rails=3.2.6

rubyonrails Rails=3.2.7

rubyonrails Rails=3.2.8

rubyonrails Rails=3.2.10

rubyonrails Rails=3.2.11

rubyonrails Rails=3.2.12

rubyonrails Rails=3.2.13-rc1

rubyonrails Rails=3.2.13-rc2

rubyonrails Rails=3.2.15-rc3

rubyonrails Rails=3.2.16

rubyonrails Rails=3.2.17

rubyonrails Rails=3.2.18

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1

rubyonrails Rails=4.0.1-rc1

rubyonrails Rails=4.0.1-rc2

rubyonrails Rails=4.0.1-rc3

rubyonrails Rails=4.0.1-rc4

rubyonrails Rails=4.0.2

rubyonrails Rails=4.0.3

rubyonrails Rails=4.0.4

rubyonrails Rails=4.0.5

rubyonrails Rails=4.0.6

rubyonrails Rails=4.0.6-rc1

rubyonrails Rails=4.0.6-rc2

rubyonrails Rails=4.0.6-rc3

rubyonrails Rails=4.0.7

rubyonrails Rails=4.0.8

rubyonrails Rails=4.0.9

rubyonrails Rails=4.0.10

rubyonrails Rails=4.0.10-rc1

rubyonrails Rails=4.1.0

rubyonrails Rails=4.1.0-beta1

rubyonrails Rails=4.1.1

rubyonrails Rails=4.1.2

rubyonrails Rails=4.1.2-rc1

rubyonrails Rails=4.1.2-rc2

rubyonrails Rails=4.1.2-rc3

rubyonrails Rails=4.1.3

rubyonrails Rails=4.1.4

rubyonrails Rails=4.1.5

rubyonrails Rails=4.1.6

rubyonrails Rails=4.1.6-rc1

rubyonrails Rails=4.2.0-beta1

rubyonrails Rails=4.2.0-beta2

rubyonrails ruby on Rails=3.0.4

rubyonrails ruby on Rails=3.2.19

openSUSE openSUSE=12.3

openSUSE openSUSE=13.1

openSUSE openSUSE=13.2

Event History

Nov 8, 2014

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2014-7818?

CVE-2014-7818 is classified as a moderate severity vulnerability due to the potential for directory traversal that may expose sensitive information.

How do I fix CVE-2014-7818?