Path Traversal in Ruby-Lang Ruby
CVE-2008-1145
Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.182 (96.9th percentile) — read the EPSS interpretation.
Affected products
- Ruby-lang Ruby — versions 1.9.0, 1.9.0.1
- Ruby-lang Webrick
- Fedoraproject Fedora — versions 7, 8
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- secalert@redhat.com (x_refsource_CONFIRM, Broken Link)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (x_refsource_SECUNIA, Not Applicable, Vendor Advisory, third-party-advisory)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
- secalert@redhat.com (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA, Broken Link)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
- secalert@redhat.com (Permissions Required, vdb-entry, x_refsource_VUPEN)