TROYANOSYVIRUS
← Voltar para CVEs

CVE-2018-3760

N/A

Descricao

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Detalhes CVE

Pontuacao CVSS v3.1N/A
Publicado6/26/2018
Ultima modificacao11/21/2024
Fontenvd
Avistamentos honeypot0

Produtos afetados

debian:debian_linuxredhat:cloudformsredhat:enterprise_linuxsprockets_project:sprockets

Fraquezas (CWE)

CWE-22CWE-200

Referencias

https://access.redhat.com/errata/RHSA-2018:2244(support@hackerone.com)
https://access.redhat.com/errata/RHSA-2018:2245(support@hackerone.com)
https://access.redhat.com/errata/RHSA-2018:2561(support@hackerone.com)
https://access.redhat.com/errata/RHSA-2018:2745(support@hackerone.com)
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5(support@hackerone.com)
https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ(support@hackerone.com)
https://www.debian.org/security/2018/dsa-4242(support@hackerone.com)
https://access.redhat.com/errata/RHSA-2018:2244(af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2245(af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2561(af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2745(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5(af854a3a-2127-422b-91ae-364da2661108)
https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ(af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2018/dsa-4242(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.