{"id":"CVE-2014-0130","aliases":["DSA-2929-1","EUVD-2017-0180","GHSA-6x85-j5j2-27jx","MGASA-2014-0303","RHSA-2014:0510","RHSA-2014:0816","UBUNTU-CVE-2014-0130"],"status":"published","title":"actionpack Path Traversal vulnerability","description":"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.53703,"percentile":0.99004,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2014-05-07T10:00:00Z","modified":"2026-06-29T10:06:59Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"exploits":[{"source":"pocgithub","id":"omarkurt/cve-2014-0130","title":"omarkurt/cve-2014-0130","date":"2014-05-08","url":"https://github.com/omarkurt/cve-2014-0130"}],"fixes":[{"ecosystem":"RubyGems","package":"actionpack","fixed_in":["3.2.18","4.0.5","4.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"ruby193-rubygem-actionpack","fixed_in":["1:3.2.8-5.5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"ruby193-rubygem-actionpack-doc","fixed_in":["1:3.2.8-5.5.el6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.18"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ruby-actionpack-3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-6+deb7u2"}]}],"versions":["3.2.6-6","3.2.6-6+deb7u1"],"bundled":3},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.18"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.2","3.2.2.rc1","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}],"versions":["4.0.0","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.2","4.0.3","4.0.4","4.0.4.rc1"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.1"}]}],"versions":["4.1.0"]},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-actionmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activemodel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-5.5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"ruby193-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-5.5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.4.2-1.el6cf"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.4.2-1.el6cf"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.4.2-1.el6cf"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.4.2-1.el6cf"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"mingw32-cfme-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.4.2-1.el6cf"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.13-8.el6cf"}]}],"bundled":7}],"products":[{"vendor":"rails","product":"ruby on rails"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"subscription_asset_manager"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-1863.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf","tags":["x_refsource_MISC","x_transferred","Broken Link","Technical Description","web"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","Broken Link","Third Party Advisory","web","report"]},{"url":"http://www.securityfocus.com/bid/67244","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0130","tags":["advisory"]},{"url":"https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/67244","tags":["web"]},{"url":"https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0510","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0816","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1863","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0130","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1095105","tags":["web","report"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o","tags":["web"]},{"url":"https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6x85-j5j2-27jx"},{"url":"https://advisories.mageia.org/MGASA-2014-0303.html","tags":["advisory"]},{"url":"http://weblog.rubyonrails.org/2014/5/6/Rails_3_2_18_4_0_5_and_4_1_1_have_been_released/","tags":["web"]},{"url":"http://weblog.rubyonrails.org/2014/6/26/Rails-4-1-2-and-4-0-6-has-been-released/","tags":["web"]},{"url":"http://weblog.rubyonrails.org/2014/7/2/Rails_3_2_19_4_0_7_and_4_1_3_have_been_released/","tags":["web"]},{"url":"http://weblog.rubyonrails.org/2014/7/2/Rails_4_0_8_and_4_1_4_have_been_released/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13659","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13339","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0510.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0130","tags":["advisory","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1087909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1089131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1107528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1107853","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0816.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0176","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0180","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0184","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1092875","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0197","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3486","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3489","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3489","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3489","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0130","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0130","description":"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.","status":"published","published":"2014-05-07T10:00:00Z","modified":"2025-10-22T00:05:37.8Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2017-0180","description":"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.","status":"published","published":"2014-05-07T10:00:00Z","modified":"2025-10-22T00:05:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T19:49:39.244432Z"}],"ghsa":[{"id":"GHSA-6x85-j5j2-27jx","title":"actionpack Path Traversal vulnerability","description":"Directory traversal vulnerability in `actionpack/lib/abstract_controller/base.rb` in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2025-10-22T19:35:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:03.380616Z"}],"kev":[{"id":"CVE-2014-0130","title":"Ruby on Rails Directory Traversal Vulnerability","description":"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.","cwes":["CWE-22"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2014-0130","description":"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.","status":"published","published":"2014-05-07T10:55:04.133Z","modified":"2026-06-17T00:02:21.133Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"GHSA-6x85-j5j2-27jx","title":"actionpack Path Traversal vulnerability","description":"Directory traversal vulnerability in `actionpack/lib/abstract_controller/base.rb` in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2025-10-24T19:34:06.97437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"UBUNTU-CVE-2014-0130","description":"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.","status":"withdrawn","published":"2014-05-07T10:55:00Z","modified":"2025-07-16T07:31:35.397416Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"DSA-2929-1","title":"ruby-actionpack-3.2 - security update","status":"published","published":"2014-05-16T00:00:00Z","modified":"2026-03-09T01:22:08.192798Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0303","title":"Updated ruby-actionpack packages fix security issues","description":"Updated ruby-actionpack and ruby-activerecord packages fix security\nvulnerabilities:\n\nDirectory traversal vulnerability in actionpack/lib/abstract_controller/base.rb\nin the implicit-render implementation in Ruby on Rails before 4.0.5, when\ncertain route globbing configurations are enabled, allows remote attackers to\nread arbitrary files via a crafted request (CVE-2014-0130).\n\nPostgreSQL supports a number of unique data types which are not present in\nother supported databases.  A bug in the SQL quoting code in ActiveRecord in\nRuby on Rails before 4.0.7 can allow an attacker to inject arbitrary SQL using\ncarefully crafted values (CVE-2014-3483).\n\nThe associated Ruby on Rails packages have been updated to version 4.0.8, to\naddress these and other issues.\n","status":"published","published":"2014-07-26T13:09:43Z","modified":"2026-04-16T06:25:06.797705834Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2014:0510","title":"Red Hat Security Advisory: ruby193-rubygem-actionpack security update","status":"published","published":"2024-09-13T08:53:05Z","modified":"2026-06-29T10:06:47Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0816","title":"Red Hat Security Advisory: cfme security, bug fix, and enhancement update","status":"published","published":"2024-09-15T21:47:33Z","modified":"2026-06-29T10:06:59Z","updated_at":"2026-11-02T15:53:02.532052Z"}]}}