CVE-2013-0262
rubygem-rack: Path sanitization information disclosure
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
rack/file.rb (Rack::File) en Rack v1.5.x anterior a v1.5.2 y v1.4.x anterior a v1.4.5 permite a atacantes acceder a ficheros arbitrarios fuera del directorio raiz mediante una variable de entorno PATH_INFO especialmente diseñada, posiblemente una vulnerabilidad de salto de directorio remotamente explotable, también conocido como "salto de directorio symlink".
Multiple vulnerabilities have been found in Rack, the worst of which allow execution of arbitrary code. Versions less than 1.4.5 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-12-06 CVE Reserved
- 2013-02-08 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://rack.github.com | X_refsource_confirm | |
| https://bugzilla.redhat.com/show_bug.cgi?id=909071 | X_refsource_misc | |
| https://gist.github.com/rentzsch/4736940 | X_refsource_misc | |
| https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56 | X_refsource_misc | |
| https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30 | X_refsource_confirm | |
| https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ | X_refsource_confirm | |
| https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html | 2023-02-13 | |
| http://secunia.com/advisories/52033 | 2023-02-13 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=909072 | 2013-03-12 | |
| https://access.redhat.com/security/cve/CVE-2013-0262 | 2013-03-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | 1.4.0 Search vendor "Rack Project" for product "Rack" and version "1.4.0" | - |
Affected
| ||||||
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | 1.4.1 Search vendor "Rack Project" for product "Rack" and version "1.4.1" | - |
Affected
| ||||||
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | 1.4.2 Search vendor "Rack Project" for product "Rack" and version "1.4.2" | - |
Affected
| ||||||
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | 1.4.3 Search vendor "Rack Project" for product "Rack" and version "1.4.3" | - |
Affected
| ||||||
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | 1.4.4 Search vendor "Rack Project" for product "Rack" and version "1.4.4" | - |
Affected
| ||||||
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | 1.5.0 Search vendor "Rack Project" for product "Rack" and version "1.5.0" | - |
Affected
| ||||||
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | 1.5.1 Search vendor "Rack Project" for product "Rack" and version "1.5.1" | - |
Affected
| ||||||