CVE Feed

    Dashboard / CVE / CVE-2013-0262

    CVE-2013-0262

    rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

    Published:Feb 8, 2013
    Last Modified:Apr 11, 2025
    EPS:Feb 8, 2013
    EPSS Score:0.00826
    CVSS Score:4.3

    Affected Products

    Vendor
    Rack Project
    Product
    Rack
    Vendor
    Redhat
    Product
    Openshift

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-26146 (CVSS 5.3) — Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to tak…
    CVE-2024-26141 (CVSS 5.8) — Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond wit…
    CVE-2024-25126 (CVSS 5.3) — Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media typ…
    CVE-2022-30122 (CVSS 7.5) — A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart par…
    CVE-2022-30123 (CVSS 10) — A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possi…
    CVE-2020-8184 (CVSS 7.5) — A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack <…
    CVE-2020-8161 (CVSS 8.6) — A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal…
    CVE-2018-16470 (CVSS 7.5) — There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests…
    CVE-2018-16471 (CVSS 6.1) — There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact t…
    CVE-2015-3225 (CVSS 5) — lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and othe…

    References

    http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
    http://rack.github.com/
    http://secunia.com/advisories/52033
    https://bugzilla.redhat.com/show_bug.cgi?id=909071
    https://bugzilla.redhat.com/show_bug.cgi?id=909072
    https://gist.github.com/rentzsch/4736940
    https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56
    https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30
    https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
    https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ
    http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
    http://rack.github.com/
    http://secunia.com/advisories/52033
    https://bugzilla.redhat.com/show_bug.cgi?id=909071
    https://bugzilla.redhat.com/show_bug.cgi?id=909072
    https://gist.github.com/rentzsch/4736940
    https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56
    https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30
    https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
    https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High