Back to search
CVE-2014-7829
Published: Nov 18, 2014
Modified: Aug 6, 2024
PUBLISHED
Description
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://puppet.com/security/cve/cve-2014-7829
x_refsource_CONFIRM
openSUSE-SU-2014:1515
vendor-advisory
x_refsource_SUSE
71183
vdb-entry
x_refsource_BID
[rubyonrails-security] 20141117 [CVE-2014-7829] Arbitrary file existence disclosure in Action Pack
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now