← CVE Radar
CVE-2016-0752Ruby on Rails Directory Traversal Vulnerability
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
7.5 HIGHEPSS 95.53%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 5.0 | MEDIUM | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:N/A:N |
CISA required action
⚡ Known exploited · remediation due Apr 15, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2016-0752
- Status
- Analyzed
- Assigner (CNA)
- redhat
- Published
- Feb 16, 2016
- Last modified
- 2026-06-17 00:38 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
rubyonrailsrails4 version ranges
- before 3.2.22.1
- 4.0.0 before 4.1.14.1
- 4.2.0 before 4.2.5.1
- 5.0.0 beta1
opensuseleap1 version range
- 42.1
opensuseopensuse1 version range
- 13.2
suselinux enterprise module for containers1 version range
- 12
debiandebian linux1 version range
- 8.0
redhatsoftware collections1 version range
- 1.0
References
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-0296.html
- debian.org http://www.debian.org/security/2016/dsa-3464
- openwall.com http://www.openwall.com/lists/oss-security/2016/01/25/13
- securityfocus.com http://www.securityfocus.com/bid/81801
- securitytracker.com http://www.securitytracker.com/id/1034816
- groups.google.com https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
- exploit-db.com https://www.exploit-db.com/exploits/40561/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752