CVE-2008-1891
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.8%
Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.
Produtos afetados
n/a · n/aReferências
http://aluigi.altervista.org/adv/webrickcgi-adv.txthttp://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.htmlhttp://secunia.com/advisories/29794http://secunia.com/advisories/30831http://secunia.com/advisories/31687https://exchange.xforce.ibmcloud.com/vulnerabilities/41824https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00937.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:140http://www.mandriva.com/security/advisories?name=MDVSA-2008:141http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/http://www.vupen.com/english/advisories/2008/1245/references