CVE-2013-0262

{"id": "CVE-2013-0262", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-02-08T20:55:01.577", "references": [{"url": "http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html", "source": "secalert@redhat.com"}, {"url": "http://rack.github.com/", "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/52033", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909072", "source": "secalert@redhat.com"}, {"url": "https://gist.github.com/rentzsch/4736940", "source": "secalert@redhat.com"}, {"url": "https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56", "source": "secalert@redhat.com"}, {"url": "https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30", "source": "secalert@redhat.com"}, {"url": "https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ", "source": "secalert@redhat.com"}, {"url": "https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka \"symlink path traversals.\""}, {"lang": "es", "value": "rack/file.rb (Rack::File) en Rack v1.5.x anterior a v1.5.2 y v1.4.x anterior a v1.4.5 permite a atacantes acceder a ficheros arbitrarios fuera del directorio raiz mediante una variable de entorno PATH_INFO especialmente dise\u00f1ada, posiblemente una vulnerabilidad de salto de directorio remotamente explotable, tambi\u00e9n conocido como \"salto de directorio symlink\"."}], "lastModified": "2023-02-13T04:40:21.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rack_project:rack:1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A3DD73E-6BD4-4C18-A4B8-AFA6860A4585"}, {"criteria": "cpe:2.3:a:rack_project:rack:1.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95E3FF6F-58C3-4491-BBD1-C4C13287A07D"}, {"criteria": "cpe:2.3:a:rack_project:rack:1.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C04A5634-62C7-4B01-B644-06A6A1D5A828"}, {"criteria": "cpe:2.3:a:rack_project:rack:1.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "290B1557-33F7-4717-B3C4-081FECF71BD5"}, {"criteria": "cpe:2.3:a:rack_project:rack:1.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAB99ED2-4E74-4652-9A04-A46436F151E6"}, {"criteria": "cpe:2.3:a:rack_project:rack:1.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F55AF59F-CA0C-4F48-81BF-C9316672886D"}, {"criteria": "cpe:2.3:a:rack_project:rack:1.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DA5F2A1-86CC-4836-A75F-9B275884683A"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}