Back to the CVE list
CVE-2014-0130 CISA KEV · Actively exploited

rubygem-actionpack: directory traversal issue

CVSS score

7.5

EPSS probability

%53.7

Risk score

8.1

Published

12 y ago

OverviewPublic Exploits (1)NewsroomVulnerability Timeline
A patch is available only for some products or versions

Kanıt listesindeki ürün ve sürüm eşleşmesini kontrol edin; bazı varyantlar hâlâ etkileniyor olabilir.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2014-0130 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted request.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2014-0130 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1Red Hatopenshift_enterprise_1:ruby193-rubygem-actionpack.src View
2Red Hatred_hat_openstack_platform_3:ruby193-rubygem-actionpack.src View
3Red Hatred_hat_openstack_platform_4:ruby193-rubygem-actionpack.src View
4Red Hatred_hat_software_collections:ror40-rubygem-actionpack View
5Red Hatred_hat_software_collections:ror40-rubygem-actionpack-doc View
6Red Hatred_hat_software_collections:ror40-rubygem-actionpack.src View
7Red Hatred_hat_subscription_asset_manager:rubygem-actionpack.src View
8Red Hat6Server-CFME:cfme-0:5.2.4.2-1.el6cf.x86_64 View
9Red Hat6Server-CFME:cfme-appliance-0:5.2.4.2-1.el6cf.x86_64 View
10Red Hat6Server-CFME:cfme-debuginfo-0:5.2.4.2-1.el6cf.x86_64 View
11Red Hat6Server-CFME:cfme-lib-0:5.2.4.2-1.el6cf.x86_64 View
12Red Hat6Server-CFME:mingw32-cfme-host-0:5.2.4.2-1.el6cf.x86_64 View
13Red Hat6Server-CFME:ruby193-rubygem-actionpack-1:3.2.13-8.el6cf.noarch View
14Red Hat6Server-RHSCL-1.0:ruby193-rubygem-actionpack-1:3.2.8-5.5.el6.noarch View
15Red Hat6Server-RHSCL-1.0:ruby193-rubygem-actionpack-1:3.2.8-5.5.el6.src View
16Red Hat6Server-RHSCL-1.0:ruby193-rubygem-actionpack-doc-1:3.2.8-5.5.el6.noarch View
17Red Hat6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src View
18Red Hat6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch View
19Red Hat6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch View
20Red Hat6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch View
21Red Hat6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch View
22Red Hat6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch View
23Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch View
24Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch View
25Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch View
26Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch View
27Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch View
28Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch View
29Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch View
30Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src View
31Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch View
32Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src View
33Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch View
34Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src View
35Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch View
36Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src View
37Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch View
38Red Hat6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src View
39Red Hat6Workstation-RHSCL-1.0:ruby193-rubygem-actionpack-1:3.2.8-5.5.el6.noarch View
40Red Hat6Workstation-RHSCL-1.0:ruby193-rubygem-actionpack-1:3.2.8-5.5.el6.src View
41Red Hat6Workstation-RHSCL-1.0:ruby193-rubygem-actionpack-doc-1:3.2.8-5.5.el6.noarch View
42railsRuby on Rails View
Total affected vendors: 2|Products: 42

RED HAT CSAF/VEX: Product Impact Check

Does this CVE affect my Red Hat product?

The results come directly from the Red Hat CSAF VEX product status; they are not estimates.

Fix released

Bu ürün dalı için Red Hat düzeltmesi yayımlanmış.

Red Hat fixes

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

Will not fix

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
7.5cvss_v2—AV:N/AC:L/Au:N/C:P/I:P/A:PRed Hat

Patch and Remediation Guide

Solution & Remediation Advisory

Partial patch

6 düzeltme kanıtı bulundu; en az 7 ürün veya sürüm hâlâ etkileniyor ya da inceleniyor.

redhat

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Open source
redhat

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Open source
redhat

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

Open source
redhat

Will not fix

redhat

Affected

reference

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Open source
reference

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Open source
reference

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

Open source
canonical

Apply updates per vendor instructions.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

CVE-2014-0130 : the database holds 1 public PoC/exploit sources for it. For direct links to the sources, open the Public Exploits tab.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2014-0130 is associated with the following CWEs:

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2014-0130 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
Permissions—
User—

Official Sources and Advisories

Canonical URLvendor-advisoryRHBZ#1095105vendor-advisoryhttps://www.cve.org/CVERecord?id=CVE-2014-0130vendor-advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2014-0130vendor-advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalogvendor-advisoryBefore applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258patchBefore applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258patchBefore applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258patch

CVSS Vector Radar Chart

7.5 / 10
Attack VectorNetworkComplexityLowPrivilegesHighUser Interact.RequiredConfidentialityLowIntegrityNoneAvailabilityNone

Vulnerability Scoring Details

AV:N/AC:L/Au:N/C:P/I:P/A:P
Attack VectorNetwork
Attack ComplexityLow
Privileges Required—
User Interaction—
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)P
Availability (Erişilebilirlik)P

Kısmi yama

6 düzeltme kanıtı bulundu; en az 7 ürün veya sürüm hâlâ etkileniyor ya da inceleniyor.

Follow the vendor

RH
Red Hat logo
Red Hat
R
rails logo
rails

Weakness Type (CWE & CAPEC)

CWE-22

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2014-0130"