CVE-2019-11879: Path Traversal
DISPUTED The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is "not a problem."
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-11879.
What is the severity of CVE-2019-11879?
The severity of CVE-2019-11879 is medium with a CVSS score of 5.5.
What is the affected software?
The affected software is the WEBrick gem version 1.4.2 for Ruby.
How does CVE-2019-11879 work?
CVE-2019-11879 allows a directory traversal attack if an attacker had local access to create a symlink outside of the web root directory.
Is there a fix available for CVE-2019-11879?
At the moment, there is no official fix available for CVE-2019-11879. It is advised to follow the vendor's updates for any mitigation steps or patches.