Log in Start free

Actively exploited · Published Feb 16, 2016 · Assigned by redhat

CVE-2016-0752

High 7.5 Exploited

In plain English

A high-severity path traversal in Ruby on Rails from Rails. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 95.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)95.5%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rails2:4.2.5.1-1DEBIAN-CVE-2016-0752
Debian:13rails2:4.2.5.1-1DEBIAN-CVE-2016-0752
Debian:14rails2:4.2.5.1-1DEBIAN-CVE-2016-0752
RubyGemsactionpack3.2.22.1GHSA-xrr4-p6fq-hjg7
RubyGemsactionpack4.1.14.1GHSA-xrr4-p6fq-hjg7
RubyGemsactionpack4.2.5.1GHSA-xrr4-p6fq-hjg7
RubyGemsactionview4.2.5.1GHSA-xrr4-p6fq-hjg7
RubyGemsactionview4.1.14.1GHSA-xrr4-p6fq-hjg7

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References