onyx --cves cve-2016-0752
CVE-2016-0752
- score
- <0.1
- cvss
- 7.5
- epss
- 95.5%
- published
- 2016-02-16
- kev added
- 2022-03-25
- first seen
Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 contain a path traversal caused by unrestricted use of the render method with '..' in pathnames, letting remote attackers read arbitrary files, exploit requires sending crafted requests with '..' in the pathname.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Added to CISA KEV
- Tracked by Onyx
- Public PoC https://www.exploit-db.com/exploits/40561/
Exploit availability
Weaknesses
References 13
- https://nvd.nist.gov/vuln/detail/CVE-2016-0752
- http://www.debian.org/security/2016/dsa-3464
- https://www.exploit-db.com/exploits/40561/
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
- https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits--targeting-scada
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
- http://www.openwall.com/lists/oss-security/2016/01/25/13
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
- https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
- http://rhn.redhat.com/errata/RHSA-2016-0296.html