CVE-2016-0752
HighActively exploited (CISA KEV)
Description
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Rails Ruby on Rails
PublishedFeb 16, 2016
First seenFeb 16, 2016
Added to KEVMar 25, 2022
Weakness typeCWE-22Path traversal
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Apr 15, 2022Update
- rubyonrails rails3.2.22.1, 4.1.14.1, 4.2.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubyonrails rails | v < 3.2.22.1, 4.0.0 ≤ v < 4.1.14.1, 4.2.0 ≤ v < 4.2.5.1, 5.0.0 | 3.2.22.1, 4.1.14.1, 4.2.5.1 |
| opensuse leap | 42.1 | — |
| opensuse opensuse | 13.2 | — |
| suse linux_enterprise_module_for_containers | 12 | — |
| debian debian_linux | 8.0 | — |
| redhat software_collections | 1.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.