高危
Ruby on Rails Action View目录遍历漏洞
2016-01-31 00:00:00 公开 ，2026-02-19 16:58:22 更新
- 关键漏洞
- CISA KEV
- 远程
- 公开PoC
- 无需认证
- CWE Top 25 (2023)
- 开源组件漏洞
- CWE Top 25 (2024)
- CWEs：
- CWE-22 （Path Traversal）
- SSVC：
- 可利用状态：已被积极利用攻击自动化：是技术影响评估：部分 2025-02-07 21:26:36
风险信息
- CVSS v2 向量
- AV:N/AC:L/Au:N/C:P/I:N/A:N
- CVSS v2 风险值
- 5
- CVSS v3 向量
- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3 风险值
- 7.5
- CVSS v3.1 向量
- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3.1 风险值
- 7.5
详细信息
- 漏洞类型
- 路径遍历
- 漏洞描述
- Ruby on Rails（Rails）是Rails核心团队开发维护的一套基于Ruby语言的开源Web应用框架，它是由大卫-海纳梅尔-韩森从美国37signals公司的项目管理工具Basecamp里分离出来的。Action View是其中的一个用于渲染视图并可以在任何Ruby代码库中使用的独立代码库。Ruby on Rails的Action View中存在目录遍历漏洞。远程攻击者可借助应用程序对render方法的无限制使用和路径名中的目录遍历字符..利用该漏洞读取任意文件。以下版本受到影响：Ruby on Rails 3.2.22.1之前版本，4.1.14.1之前4.0.x版本和4.1.x版本，4.2.5.1之前4.2.x版本，5.0.0.beta1.1之前5.x版本。
- 修复建议
- 升级至Ruby on Rails的最新版本（3.2.22.1、4.1.14.1或4.2.5.1或更高版本），可从Ruby on Rails网站获得： http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
参考链接
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
OSV · vendor-advisory · x_refsource_SUSE
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
OSV · vendor-advisory · x_refsource_SUSE
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
OSV · mailing-list · x_refsource_MLIST
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
OSV · vendor-advisory · x_refsource_FEDORA
- http://rhn.redhat.com/errata/RHSA-2016-0296.html
OSV · vendor-advisory · x_refsource_REDHAT
- https://www.exploit-db.com/exploits/40561/
OSV · exploit · x_refsource_EXPLOIT-DB
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
OSV · vendor-advisory · x_refsource_SUSE
- http://www.openwall.com/lists/oss-security/2016/01/25/13
OSV · mailing-list · x_refsource_MLIST
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
OSV · vendor-advisory · x_refsource_FEDORA
- http://www.debian.org/security/2016/dsa-3464
OSV · vendor-advisory · x_refsource_DEBIAN
- https://nvd.nist.gov/vuln/detail/CVE-2016-0752
OSV
- https://github.com/advisories/GHSA-xrr4-p6fq-hjg7
OSV
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0752.yml
OSV
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-0752.yml
OSV
- https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
OSV
- https://web.archive.org/web/20210618005620/https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
OSV
- https://web.archive.org/web/20210621170450/http://www.securityfocus.com/bid/81801
OSV
- https://web.archive.org/web/20210723192420/http://www.securitytracker.com/id/1034816
OSV
- https://www.exploit-db.com/exploits/40561
OSV · Exploit · VDB Entry · Third Party Advisory
- https://osv.dev/vulnerability/GHSA-xrr4-p6fq-hjg7
OSV
- https://osv.dev/vulnerability/DLA-604-1
OSV
- http://www.securityfocus.com/bid/81801
OSV
- http://www.securitytracker.com/id/1034816
OSV
- https://osv.dev/vulnerability/CVE-2016-0752
OSV
- https://osv.dev/vulnerability/DSA-3464-1
OSV
- https://security-tracker.debian.org/tracker/CVE-2016-0752
OSV
- https://ubuntu.com/security/CVE-2016-0752
OSV
- https://marc.info/?l=oss-security&m=145375068928706&w=2
OSV
- https://www.cve.org/CVERecord?id=CVE-2016-0752
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2016-0752
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2016-0752
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752
NVD · US Government Resource