First published: Tue Feb 16 2016(Updated: )
Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
rubygems/actionpack | <3.2.22.1 | 3.2.22.1 |
rubygems/actionpack | >=4.2.0<=4.2.5.0 | 4.2.5.1 |
rubygems/actionpack | >=4.0.0<=4.1.14.0 | 4.1.14.1 |
rubygems/actionview | >=4.2.0<=4.2.5.0 | 4.2.5.1 |
rubygems/actionview | >=4.0.0<=4.1.14.0 | 4.1.14.1 |
Ruby on Rails | ||
Ruby on Rails | =4.0.0 | |
Ruby on Rails | =4.0.0-beta | |
Ruby on Rails | =4.0.0-rc1 | |
Ruby on Rails | =4.0.0-rc2 | |
Ruby on Rails | =4.0.1 | |
Ruby on Rails | =4.0.1-rc1 | |
Ruby on Rails | =4.0.1-rc2 | |
Ruby on Rails | =4.0.1-rc3 | |
Ruby on Rails | =4.0.1-rc4 | |
Ruby on Rails | =4.0.2 | |
Ruby on Rails | =4.0.3 | |
Ruby on Rails | =4.0.4 | |
Ruby on Rails | =4.0.5 | |
Ruby on Rails | =4.0.6 | |
Ruby on Rails | =4.0.6-rc1 | |
Ruby on Rails | =4.0.6-rc2 | |
Ruby on Rails | =4.0.6-rc3 | |
Ruby on Rails | =4.0.7 | |
Ruby on Rails | =4.0.8 | |
Ruby on Rails | =4.0.9 | |
Ruby on Rails | =4.0.10-rc1 | |
Ruby on Rails | =4.1.0 | |
Ruby on Rails | =4.1.0-beta1 | |
Ruby on Rails | =4.1.1 | |
Ruby on Rails | =4.1.2 | |
Ruby on Rails | =4.1.2-rc1 | |
Ruby on Rails | =4.1.2-rc2 | |
Ruby on Rails | =4.1.2-rc3 | |
Ruby on Rails | =4.1.3 | |
Ruby on Rails | =4.1.4 | |
Ruby on Rails | =4.1.5 | |
Ruby on Rails | =4.1.6-rc1 | |
Ruby on Rails | =4.1.7 | |
Ruby on Rails | =4.1.8 | |
Ruby on Rails | =4.1.9 | |
Ruby on Rails | =4.1.10 | |
Ruby on Rails | =4.1.12 | |
Ruby on Rails | =4.1.13 | |
Ruby on Rails | =4.1.14 | |
Ruby on Rails | =4.2.0-beta1 | |
Ruby on Rails | =4.2.1 | |
Ruby on Rails | =4.2.2 | |
Ruby on Rails | =4.2.3 | |
Ruby on Rails | =4.2.3-rc1 | |
Ruby on Rails | =4.2.4 | |
Ruby on Rails | =4.2.4-rc1 | |
Ruby on Rails | =4.2.5 | |
Ruby on Rails | =4.2.5-rc1 | |
Ruby on Rails | =4.2.5-rc2 | |
Ruby on Rails | =5.0.0-beta1 | |
Ruby on Rails | <=3.2.22 | |
Ruby on Rails | =4.1.11 | |
Ruby on Rails | <3.2.22.1 | |
Ruby on Rails | >=4.0.0<4.1.14.1 | |
Ruby on Rails | >=4.2.0<4.2.5.1 | |
SUSE Linux | =42.1 | |
openSUSE | =13.2 | |
SUSE Linux Enterprise Module for Containers | =12 | |
Debian Linux | =8.0 | |
Red Hat Software Collections | =1.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability CVE-2016-0752 is classified as a high severity issue due to its potential for file reading exploitation.
To fix CVE-2016-0752, upgrade Action View to version 3.2.22.1 or later, and also update Action Pack to the corresponding secure versions.
CVE-2016-0752 affects Ruby on Rails versions prior to 3.2.22.1, 4.0.x prior to 4.1.14.1, 4.1.x prior to 4.1.14.1, 4.2.x prior to 4.2.5.1, and 5.x prior to 5.0.0.beta1.1.
Yes, CVE-2016-0752 can be exploited remotely, allowing attackers to read arbitrary files on the server.
CVE-2016-0752 is a directory traversal vulnerability that allows unauthorized file access through improperly validated paths in Action View.