GHSA-2pwf-xwr3-hp55
Moderate severity vulnerability that affects actionview
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
3.2.22.2- Upgrade actionview to this version or later
Description
Withdrawn, accidental duplicate publish.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| actionview | >= 3.2.0, < 3.2.22.2 |
3.2.22.2 |
| actionview | >= 4.0.0, < 4.1.14.2 |
4.1.14.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
actionview RubyGems → 3.2.22.2
- bundler
bundle update actionview # Gemfile: gem "actionview", ">= 3.2.22.2"
References
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2019-5418 Path Traversal in Action View | High Known exploited | Also affects actionview |
| GHSA-xrr4-p6fq-hjg7 Directory traversal vulnerability in Action View in Ruby on Rails | High Known exploited | Also affects actionview |
| GHSA-v55j-83pf-r9cq Rails has a possible XSS vulnerability in its Action View tag helpers | Low | Also affects actionview |
| GHSA-xp5h-f8jf-rc8q rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements | Medium | Also affects actionview |
| GHSA-ch3h-j2vf-95pv XSS Vulnerability in Action View tag helpers | Medium | Also affects actionview |
| GHSA-cfjv-5498-mph5 XSS in Action View | Medium | Also affects actionview |
| GHSA-cr3x-7m39-c6jq Remote code execution via user-provided local names in ActionView | High | Also affects actionview |
| GHSA-xq5j-gw7f-jgj8 CSRF Vulnerability in rails-ujs | Medium | Also affects actionview |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor