Read the docs
TI-2014-00124 Aliases CVE-2014-0130GHSA-6x85-j5j2-27jx

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the…

Priority CRITICAL 92Exploited in the wildCWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Why it matters now

Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15
EPSS 0.53703 99th percentileScored 2026-11-07
Fix Partial actionpack (RubyGems): 3.2.18, 4.0.5, 4.1.1Red Hat: 3 advisoriesRed Hat: 4 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—actionpack (RubyGems)3.0.0 to before 3.2.183.2.18Patch availableGHSA-6x85-j5j2-27jx
—actionpack (RubyGems)4.0.0 to before 4.0.54.0.5Patch availableGHSA-6x85-j5j2-27jx
—actionpack (RubyGems)4.1.0 to before 4.1.14.1.1Patch availableGHSA-6x85-j5j2-27jx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • actionpack (RubyGems) Vendor— Affected 3.0.0 to before 3.2.18 Fixed in 3.2.18 Patch available GHSA-6x85-j5j2-27jx
  • actionpack (RubyGems) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-6x85-j5j2-27jx
  • actionpack (RubyGems) Vendor— Affected 4.1.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-6x85-j5j2-27jx

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:subscription_asset_manager:*:*:*:*:*:*:*:*up to 1.3.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*before 3.2.18; 4.0.0 to before 4.0.5; 4.1.0 to before 4.1.1VulnerableRails
  • cpe:2.3:a:redhat:subscription_asset_manager:*:*:*:*:*:*:*:* Versions up to 1.3.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions before 3.2.18; 4.0.0 to before 4.0.5; 4.1.0 to before 4.1.1 Vulnerable ·Rails

Remediation

  • Fix · GHSA-6x85-j5j2-27jx actionpack (RubyGems) Fixed in 3.2.18 Advisory →
  • Fix · GHSA-6x85-j5j2-27jx actionpack (RubyGems) Fixed in 4.0.5 Advisory →
  • Fix · GHSA-6x85-j5j2-27jx actionpack (RubyGems) Fixed in 4.1.1 Advisory →

Red Hat 3 advisories

  • RHSA-2014:1863 Released 2014-11-17 · Red Hat rating Important
    Subscription Asset Manager 1.4 security update
    • Red Hat Subscription Asset Manager for RHEL 6 Server katello-1.4.3.28-1.el6sam_splice, katello-common-1.4.3.28-1.el6sam_splice, katello-glue-candlepin-1.4.3.28-1.el6sam_splice +14
  • RHSA-2014:0816 Released 2014-06-30 · Red Hat rating Important
    cfme security, bug fix, and enhancement update
    • Management Engine cfme-5.2.4.2-1.el6cf, cfme-appliance-5.2.4.2-1.el6cf, cfme-lib-5.2.4.2-1.el6cf +2
  • RHSA-2014:0510 Released 2014-05-15 · Red Hat rating Moderate
    ruby193-rubygem-actionpack security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) ruby193-rubygem-actionpack-1:3.2.8-5.5.el6, ruby193-rubygem-actionpack-doc-1:3.2.8-5.5.el6
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) ruby193-rubygem-actionpack-1:3.2.8-5.5.el6, ruby193-rubygem-actionpack-doc-1:3.2.8-5.5.el6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 3AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 4AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix yet
Red Hat Subscription Asset ManagerAffectedNo fix yet
Management EngineFixed RHSA-2014:0816
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:0510
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:0510
Red Hat Subscription Asset Manager for RHEL 6 ServerFixed RHSA-2014:1863

Timeline

  1. 2022-03-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2014-0130
  3. 2026-10-03 Alias added: GHSA-6x85-j5j2-27jx
  4. 2026-11-04 EPSS moved to the 99th percentile and above

References

Advisory 3

Other 12

  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
  • TI-2013-00263 lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences