What is CVE-2016-0752?

CVE-2016-0752 is a high-severity vulnerability in Rubyonrails Rails, classified under Path Traversal. CVSS score: 7.5/10. Published 2016-02-16.

How severe is CVE-2016-0752?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2016-0752 known to be exploited?

Yes. CVE-2016-0752 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-03-25), indicating it is being actively exploited. 23 public proof-of-concept repositories are indexed.

Path Traversal in Rubyonrails Rails

CVE-2016-0752

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an applica…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.955 (99.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Rubyonrails Rails — versions 5.0.0
Debian Debian_linux — versions 8.0
Opensuse Leap — versions 42.1
Opensuse — versions 13.2
Redhat Software_collections — versions 1.0
Suse Linux_enterprise_module_for_containers — versions 12
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2022-03-25. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2022-04-15.

Required action: Apply updates per vendor instructions.

Public proof-of-concept exploits

References

secalert@redhat.com (Exploit, VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Exploit, Mailing List)
secalert@redhat.com (Permissions Required, vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
secalert@redhat.com (Permissions Required, vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Broken Link)

Frequently asked questions

What is CVE-2016-0752?: CVE-2016-0752 is a high-severity vulnerability in Rubyonrails Rails, classified under Path Traversal. CVSS score: 7.5/10. Published 2016-02-16.
How severe is CVE-2016-0752?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2016-0752 known to be exploited?: Yes. CVE-2016-0752 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-03-25), indicating it is being actively exploited. 23 public proof-of-concept repositories are indexed.