Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
CVE-2013-0262
CVE information
Published
Last Modified
CVSSv2.0 Severity
Impact Analysis
Description
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals.".
CVSSv2.0 Score
- Severity
- Medium
- Base Score
- 4.3/10
- Exploit Score
- 8.6/10
- Access Vector
- Network
- Access Complexity
- Medium
- Authentication Required
- None
- Impact Score
- 2.9/10
- Confidentiality Impact
- Partial
- Availability Impact
- None
- Integrity Impact
- None
Products Affected
CPE | Affected | Vulnerable | Excluding | Edit |
---|---|---|---|---|
cpe:2.3:a:rack_project:rack:1.4.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
cpe:2.3:a:rack_project:rack:1.4.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
cpe:2.3:a:rack_project:rack:1.4.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
cpe:2.3:a:rack_project:rack:1.4.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
cpe:2.3:a:rack_project:rack:1.5.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
cpe:2.3:a:rack_project:rack:1.4.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
cpe:2.3:a:rack_project:rack:1.5.0:*:*:*:*:*:*:* |
Yes
|
- | - |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=909072
- http://secunia.com/advisories/52033
- http://rack.github.com/
- https://gist.github.com/rentzsch/4736940
- https://bugzilla.redhat.com/show_bug.cgi?id=909071
- https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56
- https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
- https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
- https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ