CVE-2014-7818 medium severity vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2014-7818 - Medium Vulnerability

⚠️ Vulnerable Library - actionpack-3.0.1.gem

path: /tmp/git/sample_app/Gemfile.lock

Dependency Hierarchy:

• factory_girl_rails-1.0.gem (Root Library)
  • rails-3.0.1.gem
    • actionmailer-3.0.1.gem
      • ❌ actionpack-3.0.1.gem (Vulnerable Library)

🔴 Vulnerability Details

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Publish Date: 2014-11-08

URL: CVE-2014-7818

🎯 CVSS 2 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

---

Want to learn more about the open source vulnerabilities in your products? Click here