CVE-2013-0262

Rack < 1.5.2 - Path Traversal

Title source: rule
STIX 2.1

Description

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

References (10)

Core 10
Core References
Various Sources x_refsource_misc
https://gist.github.com/rentzsch/4736940
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/52033
Various Sources x_refsource_confirm
http://rack.github.com/
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=909071
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=909072

Scores

EPSS 0.0126
EPSS Percentile 79.6%

Details

CWE
CWE-22
Status published
Products (8)
rack_project/rack 1.4.0
rack_project/rack 1.4.1
rack_project/rack 1.4.2
rack_project/rack 1.4.3
rack_project/rack 1.4.4
rack_project/rack 1.5.0
rack_project/rack 1.5.1
rubygems/rack 1.5.0 - 1.5.2RubyGems
Published Feb 08, 2013
Tracked Since Feb 18, 2026