rubygem-actionpack: directory traversal issue
Published May 7, 2014 ·Due Apr 15, 2022
7.5
HIGHCVSS 3.1
EPSS 53.70%
Description
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Affected products
No data.
Configuration 1
- ≤ 1.3.0
- 6.0
Configuration 2
- < 3.2.18
- ≥ 4.0.0 · < 4.0.5
- ≥ 4.1.0 · < 4.1.1
No data.
CloudForms Management Engine 5.x
cfme-0:5.2.4.2-1.el6cf
Fixed · RHSA-2014:0816
CloudForms Management Engine 5.x
ruby193-rubygem-actionpack-1:3.2.13-8.el6cf
Fixed · RHSA-2014:0816
Red Hat Software Collections for RHEL-6
ruby193-rubygem-actionpack-1:3.2.8-5.5.el6
Fixed · RHSA-2014:0510
Red Hat Subscription Asset Manager 1.4
katello-0:1.4.3.28-1.el6sam_splice
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-actionpack-1:3.2.17-6.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-activemodel-1:3.2.17-1.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-activerecord-1:3.2.17-5.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-activeresource-1:3.2.17-1.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-activesupport-1:3.2.17-2.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-i18n-0:0.6.9-1.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-mail-0:2.5.4-1.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-rack-1:1.4.5-3.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-rails-1:3.2.17-1.el6sam
Fixed · RHSA-2014:1863
Red Hat Subscription Asset Manager 1.4
ruby193-rubygem-railties-1:3.2.17-1.el6sam
Fixed · RHSA-2014:1863
OpenShift Enterprise 1
ruby193-rubygem-actionpack
Will not fix
Red Hat OpenStack Platform 3
ruby193-rubygem-actionpack
Will not fix
Red Hat OpenStack Platform 4
ruby193-rubygem-actionpack
Will not fix
Red Hat Software Collections
ror40-rubygem-actionpack
Affected
Red Hat Subscription Asset Manager
rubygem-actionpack
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| CloudForms Management Engine 5.x | cfme-0:5.2.4.2-1.el6cf | Fixed | RHSA-2014:0816 |
| CloudForms Management Engine 5.x | ruby193-rubygem-actionpack-1:3.2.13-8.el6cf | Fixed | RHSA-2014:0816 |
| Red Hat Software Collections for RHEL-6 | ruby193-rubygem-actionpack-1:3.2.8-5.5.el6 | Fixed | RHSA-2014:0510 |
| Red Hat Subscription Asset Manager 1.4 | katello-0:1.4.3.28-1.el6sam_splice | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-actionpack-1:3.2.17-6.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-activemodel-1:3.2.17-1.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-activerecord-1:3.2.17-5.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-activeresource-1:3.2.17-1.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-activesupport-1:3.2.17-2.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-i18n-0:0.6.9-1.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-mail-0:2.5.4-1.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-rack-1:1.4.5-3.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-rails-1:3.2.17-1.el6sam | Fixed | RHSA-2014:1863 |
| Red Hat Subscription Asset Manager 1.4 | ruby193-rubygem-railties-1:3.2.17-1.el6sam | Fixed | RHSA-2014:1863 |
| OpenShift Enterprise 1 | ruby193-rubygem-actionpack | Will not fix | n/a |
| Red Hat OpenStack Platform 3 | ruby193-rubygem-actionpack | Will not fix | n/a |
| Red Hat OpenStack Platform 4 | ruby193-rubygem-actionpack | Will not fix | n/a |
| Red Hat Software Collections | ror40-rubygem-actionpack | Affected | n/a |
| Red Hat Subscription Asset Manager | rubygem-actionpack | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1 other source (GHSA) ▾
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
No CVSS v3.0 score for this CVE.
AV:N/AC:M/Au:N/C:P/I:N/A:N
Date Added
Mar 25, 2022
Patch Due
Apr 15, 2022
Required Action
Apply updates per vendor instructions.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Feb 7, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (31 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 53.70% (0.53703) | 98.97th | v5 (v2026.06.15) |
| Jun 15, 2026 | 53.70% (0.53703) | 98.86th | v5 (v2026.06.15) |
| Apr 26, 2026 | 52.71% (0.52710) | 97.95th | v4 (v2025.03.14) |
| Apr 23, 2026 | 50.68% (0.50682) | 97.87th | v4 (v2025.03.14) |
| Apr 22, 2026 | 57.00% (0.56997) | 98.14th | v4 (v2025.03.14) |
| Mar 4, 2026 | 45.37% (0.45374) | 97.53th | v4 (v2025.03.14) |
| Mar 1, 2026 | 48.56% (0.48558) | 97.70th | v4 (v2025.03.14) |
| Feb 4, 2026 | 45.37% (0.45374) | 97.50th | v4 (v2025.03.14) |
| Feb 1, 2026 | 48.56% (0.48558) | 97.67th | v4 (v2025.03.14) |
| Jan 4, 2026 | 45.37% (0.45374) | 97.48th | v4 (v2025.03.14) |
| Jan 1, 2026 | 48.56% (0.48558) | 97.66th | v4 (v2025.03.14) |
| Dec 22, 2025 | 45.37% (0.45374) | 97.47th | v4 (v2025.03.14) |
| Jul 13, 2025 | 43.67% (0.43668) | 97.37th | v4 (v2025.03.14) |
| Jun 20, 2025 | 36.44% (0.36438) | 96.92th | v4 (v2025.03.14) |
| May 26, 2025 | 25.56% (0.25556) | 95.92th | v4 (v2025.03.14) |
| Mar 30, 2025 | 20.50% (0.20498) | 95.08th | v4 (v2025.03.14) |
| Mar 29, 2025 | 73.53% (0.73534) | 98.43th | v4 (v2025.03.14) |
| Mar 28, 2025 | 20.50% (0.20498) | 95.08th | v4 (v2025.03.14) |
| Mar 27, 2025 | 73.53% (0.73534) | 98.68th | v4 (v2025.03.14) |
| Mar 20, 2025 | 20.50% (0.20498) | 95.11th | v4 (v2025.03.14) |
| Mar 19, 2025 | 73.53% (0.73534) | 98.71th | v4 (v2025.03.14) |
| Mar 17, 2025 | 20.50% (0.20498) | 95.09th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.54% (0.00539) | 78.01th | v3 (v2023.03.01) |
| Jul 17, 2024 | 0.54% (0.00539) | 77.46th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.33% (0.00328) | 70.14th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.33% (0.00328) | 66.27th | v3 (v2023.03.01) |
| Mar 6, 2023 | 15.35% (0.15351) | 95.97th | v2 (v2022.01.01) |
| Feb 13, 2023 | 15.35% (0.15351) | 95.82th | v2 (v2022.01.01) |
| Feb 3, 2023 | 27.34% (0.27336) | 97.12th | v2 (v2022.01.01) |
| Apr 1, 2022 | 15.35% (0.15351) | 95.60th | v2 (v2022.01.01) |
| Feb 4, 2022 | 15.35% (0.15351) | 91.59th | v2 (v2022.01.01) |
References (19)
- http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf x_refsource_MISCBroken LinkTechnical Description
- http://rhn.redhat.com/errata/RHSA-2014-1863.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.securityfocus.com/bid/67244 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2014:0510
- https://access.redhat.com/errata/RHSA-2014:0816
- https://access.redhat.com/errata/RHSA-2014:1863
- https://access.redhat.com/security/cve/CVE-2014-0130 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1095105 Issue Tracking
- https://github.com/advisories/GHSA-6x85-j5j2-27jx Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ mailing-listx_refsource_MLISTBroken LinkThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2014-0130
- https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/67244
- https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
- https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130 government-resourceUS Government Resource
- https://www.cve.org/CVERecord?id=CVE-2014-0130
Change history (0)
No recorded changes yet.