CVE-2018-3760
High
Description
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Sprockets
PublishedJun 26, 2018
First seenJun 26, 2018
Weakness typeCWE-22Path traversal
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sprockets_project sprockets | 2.0.0 ≤ v ≤ 2.12.4, 3.0.0 ≤ v ≤ 3.7.1, 4.0.0 | — |
| redhat cloudforms | 4.5, 4.6 | — |
| redhat enterprise_linux | 6.0, 6.7, 7.0, 7.3, 7.4, 7.5, 7.6 | — |
| debian debian_linux | 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.