onyx --cves cve-2016-2097
CVE-2016-2097
- score
- <0.1
- cvss
- 5.3
- epss
- 4.4%
- published
- 2016-04-07
- kev added
- —
- first seen
Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 contain a path traversal caused by incomplete fix for CVE-2016-0752 in Action View, letting remote attackers read arbitrary files by providing a .. in pathname, exploit requires attacker to control the pathname parameter.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 8
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ
- http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
- http://www.debian.org/security/2016/dsa-3509
- http://www.securityfocus.com/bid/83726
- http://www.securitytracker.com/id/1035122