CVE-2008-1145
- State
- Published
- Severity
- Not scored
- Published
- Mar 4, 2008
- Updated
- Aug 7, 2024
- Reserved
- Mar 4, 2008
Description
Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- SUSE-SR:2008:017vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0123
- http://support.apple.com/kb/HT2163
- 29357third-party-advisory
- 20080325 rPSA-2008-0123-1 rubymailing-list
- VU#404515third-party-advisory
- 28123vdb-entry
- MDVSA-2008:141vendor-advisory
- 20080306 [DSECRG-08-018] Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory traversal file Download Vulnerabilitymailing-list
- ADV-2008-1981vdb-entry
- 5215exploit
- 29232third-party-advisory
- ruby-webrick-directory-traversal(41010)vdb-entry
- 31687third-party-advisory
- 20080306 Re: [DSECRG-08-018] Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory traversal file Download Vulnerabilitymailing-list
- FEDORA-2008-2458vendor-advisory
- RHSA-2008:0897vendor-advisory
- APPLE-SA-2008-06-30vendor-advisory
- http://www.ruby-lang.org/en/news/2008/03/03/webrick-file-access-vulnerability/
- ADV-2008-0787vdb-entry
- 30802third-party-advisory
- oval:org.mitre.oval:def:10937vdb-entrysignature
- 1019562vdb-entry
- https://issues.rpath.com/browse/RPL-2338
- 32371third-party-advisory
- MDVSA-2008:142vendor-advisory
- 29536third-party-advisory
- FEDORA-2008-2443vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0123
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.