CVE-2014-0130

Ruby on Rails Directory Traversal Vulnerability

Rails — Ruby on Rails

Added to KEV catalog: 25 March 2022
Federal remediation due date: 15 April 2022
Weakness classification (CWE): CWE-22

CISA Description

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2014-0130

View on NVD View on MITRE CVE View full CISA catalog

More Rails Vulnerabilities

CVE-2019-5418

Rails Ruby on Rails Path Traversal Vulnerability

CVE-2016-0752

Ruby on Rails Directory Traversal Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services