GHSA-xrr4-p6fq-hjg7 · 嚴重度： high · 生態： rubygems — Directory traversal vulnerability in Action View in Ruby on Rails
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
結論預警: CVE-2016-0752 綜合評估為嚴重在野威脅（95/100）：CVSS 技術影響為高級，利用機率偏高（EPSS 95.54%，百分位 100%） 核心證據: CISA 已知被利用漏洞目錄（KEV）已於 2022-03-25 確認在野利用，影響 Rails / Ruby on Rails，弱點類型（CWE-22），攻擊者可能未經認證遠端取得高權限管理存取。 近一日 EPSS 上升 +5.04%，被利用關注度持續升高。 強制指令: CISA 處置期限已過，應以應急修補優先立即處理。
風險隨態勢動態變化；本站持續評估並同步更新本頁展示內容。
: Ruby on Rails Directory Traversal Vulnerability · CISA KEV 詳情
: 2022-03-25
: 2022-04-15
: Apply updates per vendor instructions.
| EDB-ID | 來源 | 類型 | 公開時間 | 連結 |
|---|---|---|---|---|
| 40561 | exploit_db | edb | 2016-10-17 | Exploit-DB ↗ |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS 日更估計相對被利用可能性；百分位表示該 CVE 在已評分漏洞中的相對排名（越高表示相對更嚴重）。
| # | 日期 | 舊 EPSS 分數 | 新 EPSS 分數 | 變化（新 − 舊） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 90.49% | 95.54% | +5.04% |
| 2 | 2026-05-23 | 91.05% | 90.49% | -0.56% |
| 3 | 2026-03-18 | — | 91.05% | — |
完整 EPSS 歷史 （共 41 筆）
該 CVE 的 CVSS 指標。
| 底座分 | 版本 | 嚴重度 | 向量 | 可利用性 | 影響 | 分數來源 |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
GHSA-xrr4-p6fq-hjg7 · 嚴重度： high · 生態： rubygems — Directory traversal vulnerability in Action View in Ruby on Rails
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2016-0752 not yet assigned priority: Debian including 1 source packages (rails), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2016-0752 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2016-0752 |
suse
|
medium | CVE-2016-0752 severity moderate: SUSE including 17 source package names (libcontainment-insomnia-0.1.1-0.9.4.19, libjansson4-2.2.1-0.9.11.6, …), 33 product×package rows across 9 product lines (SUSE Enterprise Storage 2.1, SUSE Lifecycle Management Server 1.3, … (9 product lines)): Fixed 33. | https://www.suse.com/security/cve/CVE-2016-0752/ |
ubuntu
|
medium | CVE-2016-0752 medium priority: Ubuntu including 10 source packages (rails, rails-4.0, …), 120 status rows across 12 suites (artful, bionic, cosmic, disco, precise, trusty, upstream, vivid, wily, xenial, yakkety, zesty): DNE 96, ignored 12, needs-triage 5, not-affected 5, released 2. | https://ubuntu.com/security/CVE-2016-0752 |
| 廠商 | 產品 | 版本 | 原始 CPE |
|---|---|---|---|
| rubyonrails | rails | < 3.2.22.1 | cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* |
| rubyonrails | rails | >= 4.0.0, < 4.1.14.1 | cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* |
| rubyonrails | rails | >= 4.2.0, < 4.2.5.1 | cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* |
| rubyonrails | rails | 5.0.0 | cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:* |
| opensuse | leap | 42.1 | cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* |
| opensuse | opensuse | 13.2 | cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
| suse | linux_enterprise_module_for_containers | 12 | cpe:2.3:o:suse:linux_enterprise_module_for_containers:12:*:*:*:*:*:*:* |
| debian | debian_linux | 8.0 | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| redhat | software_collections | 1.0 | cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* |