CVE-2014-7829: Path Traversal
Published Nov 18, 2014
·Updated
Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when servestaticassets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
Affected Software
145 affected componentsFixes available
rubygems/actionpack>=4.2.0.beta1<4.2.0.beta4
4.2.0.beta4
rubygems/actionpack>=4.1.0<4.1.8
4.1.8
rubygems/actionpack>=4.0.0<4.0.12
4.0.12
rubygems/actionpack>=3.0.0<3.2.21
3.2.21
openSUSE openSUSE=12.3
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
rubyonrails Rails=3.0.0
rubyonrails Rails=3.0.0-beta
rubyonrails Rails=3.0.0-beta2
rubyonrails Rails=3.0.0-beta3
rubyonrails Rails=3.0.0-beta4
rubyonrails Rails=3.0.0-rc
rubyonrails Rails=3.0.0-rc2
rubyonrails Rails=3.0.1
rubyonrails Rails=3.0.1-pre
rubyonrails Rails=3.0.2
rubyonrails Rails=3.0.2-pre
rubyonrails Rails=3.0.3
rubyonrails Rails=3.0.4-rc1
rubyonrails Rails=3.0.5
rubyonrails Rails=3.0.5-rc1
rubyonrails Rails=3.0.6
rubyonrails Rails=3.0.6-rc1
rubyonrails Rails=3.0.6-rc2
rubyonrails Rails=3.0.7
rubyonrails Rails=3.0.7-rc1
rubyonrails Rails=3.0.7-rc2
rubyonrails Rails=3.0.8
rubyonrails Rails=3.0.8-rc1
rubyonrails Rails=3.0.8-rc2
rubyonrails Rails=3.0.8-rc3
rubyonrails Rails=3.0.8-rc4
rubyonrails Rails=3.0.9
rubyonrails Rails=3.0.9-rc1
rubyonrails Rails=3.0.9-rc2
rubyonrails Rails=3.0.9-rc3
rubyonrails Rails=3.0.9-rc4
rubyonrails Rails=3.0.9-rc5
rubyonrails Rails=3.0.10
rubyonrails Rails=3.0.10-rc1
rubyonrails Rails=3.0.11
rubyonrails Rails=3.0.12
rubyonrails Rails=3.0.12-rc1
rubyonrails Rails=3.0.13
rubyonrails Rails=3.0.13-rc1
rubyonrails Rails=3.0.14
rubyonrails Rails=3.0.16
rubyonrails Rails=3.0.17
rubyonrails Rails=3.0.18
rubyonrails Rails=3.0.19
rubyonrails Rails=3.0.20
rubyonrails Rails=3.1.0
rubyonrails Rails=3.1.0-beta1
rubyonrails Rails=3.1.0-rc1
rubyonrails Rails=3.1.0-rc2
rubyonrails Rails=3.1.0-rc3
rubyonrails Rails=3.1.0-rc4
rubyonrails Rails=3.1.0-rc5
rubyonrails Rails=3.1.0-rc6
rubyonrails Rails=3.1.0-rc7
rubyonrails Rails=3.1.0-rc8
rubyonrails Rails=3.1.1
rubyonrails Rails=3.1.1-rc1
rubyonrails Rails=3.1.1-rc2
rubyonrails Rails=3.1.1-rc3
rubyonrails Rails=3.1.2
rubyonrails Rails=3.1.2-rc1
rubyonrails Rails=3.1.2-rc2
rubyonrails Rails=3.1.3
rubyonrails Rails=3.1.4
rubyonrails Rails=3.1.4-rc1
rubyonrails Rails=3.1.5
rubyonrails Rails=3.1.5-rc1
rubyonrails Rails=3.1.6
rubyonrails Rails=3.1.7
rubyonrails Rails=3.1.8
rubyonrails Rails=3.1.9
rubyonrails Rails=3.1.10
rubyonrails Rails=3.2.0
rubyonrails Rails=3.2.0-rc1
rubyonrails Rails=3.2.0-rc2
rubyonrails Rails=3.2.1
rubyonrails Rails=3.2.2
rubyonrails Rails=3.2.2-rc1
rubyonrails Rails=3.2.3
rubyonrails Rails=3.2.3-rc1
rubyonrails Rails=3.2.3-rc2
rubyonrails Rails=3.2.4
rubyonrails Rails=3.2.4-rc1
rubyonrails Rails=3.2.5
rubyonrails Rails=3.2.6
rubyonrails Rails=3.2.7
rubyonrails Rails=3.2.8
rubyonrails Rails=3.2.10
rubyonrails Rails=3.2.11
rubyonrails Rails=3.2.12
rubyonrails Rails=3.2.13-rc1
rubyonrails Rails=3.2.13-rc2
rubyonrails Rails=3.2.15-rc3
rubyonrails Rails=3.2.16
rubyonrails Rails=3.2.17
rubyonrails Rails=3.2.18
rubyonrails Rails=4.0.0
rubyonrails Rails=4.0.0-beta
rubyonrails Rails=4.0.0-rc1
rubyonrails Rails=4.0.0-rc2
rubyonrails Rails=4.0.1
rubyonrails Rails=4.0.1-rc1
rubyonrails Rails=4.0.1-rc2
rubyonrails Rails=4.0.1-rc3
rubyonrails Rails=4.0.1-rc4
rubyonrails Rails=4.0.2
rubyonrails Rails=4.0.3
rubyonrails Rails=4.0.4
rubyonrails Rails=4.0.5
rubyonrails Rails=4.0.6
rubyonrails Rails=4.0.6-rc1
rubyonrails Rails=4.0.6-rc2
rubyonrails Rails=4.0.6-rc3
rubyonrails Rails=4.0.7
rubyonrails Rails=4.0.8
rubyonrails Rails=4.0.9
rubyonrails Rails=4.0.10
rubyonrails Rails=4.0.10-rc1
rubyonrails Rails=4.1.0
rubyonrails Rails=4.1.0-beta1
rubyonrails Rails=4.1.1
rubyonrails Rails=4.1.2
rubyonrails Rails=4.1.2-rc1
rubyonrails Rails=4.1.2-rc2
rubyonrails Rails=4.1.2-rc3
rubyonrails Rails=4.1.3
rubyonrails Rails=4.1.4
rubyonrails Rails=4.1.5
rubyonrails Rails=4.1.6
rubyonrails Rails=4.1.6-rc1
rubyonrails Rails=4.1.7
rubyonrails Rails=4.2.0-beta1
rubyonrails Rails=4.2.0-beta2
rubyonrails Rails=4.2.0-beta3
rubyonrails ruby on Rails=3.0.4
rubyonrails ruby on Rails=3.2.19
rubyonrails ruby on Rails=3.2.20
rubyonrails ruby on Rails=4.0.11
Event History
Nov 18, 2014
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Oct 24, 2017
Advisory Published
06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2014-7829?
CVE-2014-7829 is classified as a moderate severity vulnerability due to its potential exploitation risk in certain configurations.
2
How do I fix CVE-2014-7829?
To fix CVE-2014-7829, upgrade Action Pack to version 4.2.0.beta4 or later, 4.1.8, 4.0.12, or 3.2.21.
3
What versions of Ruby on Rails are affected by CVE-2014-7829?
CVE-2014-7829 affects Ruby on Rails versions before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4.
4
Can CVE-2014-7829 be exploited remotely?
Yes, CVE-2014-7829 can be exploited by remote attackers to reveal the existence of files.
5
What is the impact of CVE-2014-7829?
The impact of CVE-2014-7829 is that it allows an attacker to perform directory traversal, potentially disclosing sensitive information on the server.