CVE-2018-7212: Path Traversal
Published Feb 18, 2018
·Updated
An issue was discovered in rack-protection/lib/rack/protection/pathtraversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
Affected Software
20 affected components
Sinatrarb Sinatra=2.0.0
Sinatrarb Sinatra=2.0.0-beta2
Sinatrarb Sinatra=2.0.0-rc1
Sinatrarb Sinatra=2.0.0-rc2
Sinatrarb Sinatra=2.0.0-rc3
Sinatrarb Sinatra=2.0.0-rc4
Sinatrarb Sinatra=2.0.0-rc5
Sinatrarb Sinatra=2.0.0-rc6
Sinatrarb Sinatra=2.0.1-rc1
Microsoft Windows
All of the following
Any of the following
Sinatrarb Sinatra=2.0.0
Sinatrarb Sinatra=2.0.0-beta2
Sinatrarb Sinatra=2.0.0-rc1
Sinatrarb Sinatra=2.0.0-rc2
Sinatrarb Sinatra=2.0.0-rc3
Sinatrarb Sinatra=2.0.0-rc4
Sinatrarb Sinatra=2.0.0-rc5
Sinatrarb Sinatra=2.0.0-rc6
Sinatrarb Sinatra=2.0.1-rc1
Microsoft Windows
Event History
Feb 18, 2018
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
Description
Data Sourced
via NVD·06:29 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2018-7212?
CVE-2018-7212 is a vulnerability in Sinatra 2.x before 2.0.1 on Windows that allows path traversal via backslash characters.
2
How severe is CVE-2018-7212?
CVE-2018-7212 has a severity score of 5.3, which is classified as medium.
3
How can I exploit CVE-2018-7212?
To exploit CVE-2018-7212, an attacker can use backslash characters to traverse directories and access sensitive files on a Windows system.
4
Is Sinatra 2.x affected by CVE-2018-7212?
Yes, Sinatra 2.x versions including 2.0.0, 2.0.0-beta2, 2.0.0-rc1, 2.0.0-rc2, 2.0.0-rc3, 2.0.0-rc4, 2.0.0-rc5, 2.0.0-rc6, and 2.0.1-rc1 are affected by CVE-2018-7212.
5
How do I fix CVE-2018-7212?
To fix CVE-2018-7212, upgrade to Sinatra version 2.0.1 or later.