Every CVE Search/ Get API key

CVE-2014-7819

sprockets vulnerable to Path Traversal

5.0 MediumFix available

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Exploit likelihood

3.89%Up 2.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Record
CVE-2014-7819
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Record
CVE-2014-7819
Updated
2026-11-02
EUVDEUVD-2017-0153 No score

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Record
EUVD-2017-0153
Updated
2026-11-03
GitHub AdvisoriesGHSA-33pp-3763-mrfp No score

sprockets vulnerable to Path Traversal

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Record
GHSA-33pp-3763-mrfp
Weakness
CWE-22
Updated
2026-11-02
OSV No score

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Record
CVE-2014-7819
Updated
2026-11-02
OSVDEBIAN-CVE-2014-7819 No score

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Record
DEBIAN-CVE-2014-7819
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-33pp-3763-mrfp No score

sprockets vulnerable to Path Traversal

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Record
GHSA-33pp-3763-mrfp
Weakness
CWE-22
Updated
2026-11-02
OSVMGASA-2015-0074 No score

Updated ruby-sprockets packages fix CVE-2014-7819

Updated ruby-sprockets packages fix security vulnerabilities:

Multiple directory traversal vulnerabilities in server.rb in Sprockets 2.12.x before 2.12.3, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with double slashes or URL encoding (CVE-2014-7819).

Record
MGASA-2015-0074
Updated
2026-11-02
OSVSUSE-SU-2015:0787-1 No score

Security update for rubygem-sprockets-2_11

This update for rubygem-sprockets-2_11 provides the following security fix:

* Arbitrary file existence disclosure (bnc#903658, CVE-2014-7819)

Security Issues:

* CVE-2014-7819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819>
Record
SUSE-SU-2015:0787-1
Updated
2026-11-02
OSVSUSE-SU-2015:0863-1 No score

Security update for SUSE Studio

This update provides SUSE Studio 1.3.10, including Amazon's EC2 support for SUSE Linux Enterprise 12 appliances.

Additionally, the update includes fixes for the following issues:

* #904372 - Arbitrary file existence disclosure in sprockets gem
  (CVE-2014-7819)
* #904375 - Arbitrary file existence disclosure in Action Pack gem
  (CVE-2014-7818)
* #918203 - Arbitrary file existence disclosure in Studio Onsite
  (CVE-2014-7829)
* #852794 - SLES 11-SP3 templates fail to build x86_64 EC2 images
* #914765 - Change of appliance name is not displayed in appliance's
  change log
* #887893 - Change log not accessible via API
* #918239 - Failure to create new appliances after upgrade to Studio
  Onsite 1.3.9
* #918395 - Remove 32bit as target for building EC2 appliances
* #912512 - Studio doesn't allow duplicated repositories
* #880078 - Studio packages contain files that get modified (by Studio)
  after installation.
* #919037 - Can't open appliance on Gallery: undefined
  restructure_unsupportable_packages method.

Security Issues:

* CVE-2014-7819
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819>
* CVE-2014-7818
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818>
* CVE-2014-7829
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829>
Record
SUSE-SU-2015:0863-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-7819 No score

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Record
UBUNTU-CVE-2014-7819
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sprockets
RubyGems
 before 2.0.5
2.0.5
sprockets
RubyGems
 2.1.0 up to 2.1.4
2.1.4
sprockets
RubyGems
 2.2.0 up to 2.2.3
2.2.3
sprockets
RubyGems
 2.3.0 up to 2.3.3
2.3.3
sprockets
RubyGems
 2.4.0 up to 2.4.6
2.4.6
sprockets
RubyGems
 2.5.0 up to 2.5.1
2.5.1
sprockets
RubyGems
 2.6.0 up to 2.7.1
2.7.1
sprockets
RubyGems
 2.8.0 up to 2.8.3
2.8.3
sprockets
RubyGems
 2.9.0 up to 2.9.4
2.9.4
sprockets
RubyGems
 2.10.0 up to 2.10.2
2.10.2
Show 64 moreShow less
Affected packages
PackageAffectedFixed
sprockets
RubyGems
 2.11.0 up to 2.11.3
2.11.3
sprockets
RubyGems
 2.12.0 up to 2.12.3
2.12.3
ruby-sprockets
Debian:12
 before 2.12.3-1
2.12.3-1
ruby-sprockets
Debian:13
 before 2.12.3-1
2.12.3-1
ruby-sprockets
Debian:14
 before 2.12.3-1
2.12.3-1
sprockets
RubyGems
 before 2.0.5, plus listed versions
0.9.00.9.11.0.01.0.11.0.2
Show 5 moreShow less
2.0.02.0.12.0.22.0.32.0.4
2.0.5
sprockets
RubyGems
 2.1.0 up to 2.1.4, plus listed versions
2.1.12.1.22.1.3
2.1.4
sprockets
RubyGems
 2.2.0 up to 2.2.3, plus listed versions
2.2.12.2.2
2.2.3
sprockets
RubyGems
 2.3.0 up to 2.3.3, plus listed versions
2.3.12.3.2
2.3.3
sprockets
RubyGems
 2.4.0 up to 2.4.6, plus listed versions
2.4.12.4.22.4.32.4.42.4.5
2.4.6
sprockets
RubyGems
 2.6.0 up to 2.7.1, plus listed versions
2.6.12.7.0
2.7.1
sprockets
RubyGems
 2.8.0 up to 2.8.3, plus listed versions
2.8.12.8.2
2.8.3
sprockets
RubyGems
 2.9.0 up to 2.9.4, plus listed versions
2.9.22.9.3
2.9.4
sprockets
RubyGems
 2.10.0 up to 2.10.2, plus listed versions
2.10.1
2.10.2
sprockets
RubyGems
 2.12.0 up to 2.12.3, plus listed versions
2.12.12.12.2
2.12.3
ruby-sprockets
Mageia:4
 before 2.10.0-4.1.mga4
2.10.0-4.1.mga4
cfme
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:5.4.0.5-1.el6cf
0:5.4.0.5-1.el6cf
cfme-appliance
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:5.4.0.5-1.el6cf
0:5.4.0.5-1.el6cf
cfme-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:5.4.0.5-1.el6cf
0:5.4.0.5-1.el6cf
cfme-gemset
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:5.4.0.5-1.el6cf
0:5.4.0.5-1.el6cf
cfme-lib
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:5.4.0.5-1.el6cf
0:5.4.0.5-1.el6cf
cfme-vnc-plugin
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.0.0-2.el6cf
0:1.0.0-2.el6cf
cfme-vnc-plugin-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.0.0-2.el6cf
0:1.0.0-2.el6cf
libdnet
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.12-11.el6cf
0:1.12-11.el6cf
libdnet-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.12-11.el6cf
0:1.12-11.el6cf
libdnet-devel
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.12-11.el6cf
0:1.12-11.el6cf
libdnet-progs
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.12-11.el6cf
0:1.12-11.el6cf
lshw
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:B.02.16-4.el6cf
0:B.02.16-4.el6cf
lshw-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:B.02.16-4.el6cf
0:B.02.16-4.el6cf
lshw-gui
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:B.02.16-4.el6cf
0:B.02.16-4.el6cf
netapp-manageability-sdk
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:4.0P1-3.el6cf
0:4.0P1-3.el6cf
netapp-manageability-sdk-devel
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:4.0P1-3.el6cf
0:4.0P1-3.el6cf
open-vm-tools
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:9.2.3-5.el6cf
0:9.2.3-5.el6cf
open-vm-tools-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:9.2.3-5.el6cf
0:9.2.3-5.el6cf
open-vm-tools-desktop
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:9.2.3-5.el6cf
0:9.2.3-5.el6cf
open-vm-tools-devel
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:9.2.3-5.el6cf
0:9.2.3-5.el6cf
prince
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:9.0r2-4.el6cf
0:9.0r2-4.el6cf
pyliblzma
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.5.3-7.el6cf
0:0.5.3-7.el6cf
pyliblzma-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.5.3-7.el6cf
0:0.5.3-7.el6cf
ruby200-rubygem-bcrypt-ruby
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:3.0.1-2.el6cf
0:3.0.1-2.el6cf
ruby200-rubygem-bcrypt-ruby-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:3.0.1-2.el6cf
0:3.0.1-2.el6cf
ruby200-rubygem-eventmachine
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.0.7-2.el6cf
0:1.0.7-2.el6cf
ruby200-rubygem-eventmachine-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.0.7-2.el6cf
0:1.0.7-2.el6cf
ruby200-rubygem-ffi
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.9.8-1.el6cf
0:1.9.8-1.el6cf
ruby200-rubygem-ffi-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.9.8-1.el6cf
0:1.9.8-1.el6cf
ruby200-rubygem-io-extra
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.2.8-1.el6cf
0:1.2.8-1.el6cf
ruby200-rubygem-io-extra-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.2.8-1.el6cf
0:1.2.8-1.el6cf
ruby200-rubygem-json
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.8.2-2.el6cf
0:1.8.2-2.el6cf
ruby200-rubygem-json-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.8.2-2.el6cf
0:1.8.2-2.el6cf
ruby200-rubygem-nokogiri
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.5.11-2.el6cf
0:1.5.11-2.el6cf
ruby200-rubygem-nokogiri-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.5.11-2.el6cf
0:1.5.11-2.el6cf
ruby200-rubygem-pg
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.12.2-9.el6cf
0:0.12.2-9.el6cf
ruby200-rubygem-pg-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.12.2-9.el6cf
0:0.12.2-9.el6cf
ruby200-rubygem-psych
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:2.0.13-1.el6cf
0:2.0.13-1.el6cf
ruby200-rubygem-psych-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:2.0.13-1.el6cf
0:2.0.13-1.el6cf
ruby200-rubygem-qpid_messaging
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.20.2-5.el6cf
0:0.20.2-5.el6cf
ruby200-rubygem-qpid_messaging-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.20.2-5.el6cf
0:0.20.2-5.el6cf
ruby200-rubygem-therubyracer
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.11.0-5.el6cf
0:0.11.0-5.el6cf
ruby200-rubygem-therubyracer-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.11.0-5.el6cf
0:0.11.0-5.el6cf
ruby200-rubygem-thin
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.3.1-9.el6cf
0:1.3.1-9.el6cf
ruby200-rubygem-thin-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.3.1-9.el6cf
0:1.3.1-9.el6cf
sneakernet_ca
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:0.1-2.el6cf
0:0.1-2.el6cf
wmi
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.3.14-1.el6cf
0:1.3.14-1.el6cf
wmi-debuginfo
Red Hat:cloudforms_managementengine:5::el6
From an advisory covering 5 CVEs
 before 0:1.3.14-1.el6cf
0:1.3.14-1.el6cf

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-7819 is a medium vulnerability (CVSS 5.0) in Sprockets Project Sprockets, published November 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.89%, the 90th percentile. Fixed in sprockets 2.0.5.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 247 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open