QwikSec

Security Database

CVE

CWE

Training

CVE-2014-7818

Published: Nov 8, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://puppet.com/security/cve/cve-2014-7829

x_refsource_CONFIRM

openSUSE-SU-2014:1515

vendor-advisory

x_refsource_SUSE

[rubyonrails-security] 20141030 Arbitrary file existence disclosure in Action Pack (CVE-2014-7818)

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.