CVEs / CVE-2016-0752
CVE-2016-0752: Ruby on Rails Directory Traversal Vulnerability
- Known exploited in the CISA KEV catalog since 25 Mar 2022
- high 7.5 CVSS 3.1 (NVD)
- EPSS 95.5% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2016-0752
Summary
Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
Description
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
| Product | Affected | Fixed in |
|---|---|---|
| actionview (RubyGems) | from 4.0.0, before 4.1.14.1 | 4.1.14.1 |
| actionview (RubyGems) | from 4.2.0, before 4.2.5.1 | 4.2.5.1 |
| actionpack (RubyGems) | from 4.0.0, before 4.1.14.1 | 4.1.14.1 |
| actionpack (RubyGems) | from 4.2.0, before 4.2.5.1 | 4.2.5.1 |
| actionpack (RubyGems) | before 3.2.22.1 | 3.2.22.1 |
Package versions from GHSA-xrr4-p6fq-hjg7.
Exploitation
| In CISA KEV since | 25 Mar 2022 |
|---|---|
| Due date for US federal agencies | 15 Apr 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NScored by NVD |
|---|---|
| Weakness | CWE-22 |
References
- CVE-2016-0752 on NVD
- CVE-2016-0752 in the CISA KEV catalog
- CVE-2016-0752 on OSV
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html Permissions Required
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html Permissions Required
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0296.html Third Party Advisory
- http://www.debian.org/security/2016/dsa-3464 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/01/25/13 Exploit, Mailing List
- http://www.securityfocus.com/bid/81801 Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034816 Broken Link, Third Party Advisory, VDB Entry
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ Broken Link
- https://www.exploit-db.com/exploits/40561/ Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.