7.5 High Exploited

CVE-2019-5418 Rails Ruby on Rails Path Traversal Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-22

Description

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Affected products and versions

Product	Affected versions	Fixed in
https://github.com/rails/rails	5.2.2.1	No fix stated
https://github.com/rails/rails	5.1.6.2	No fix stated
https://github.com/rails/rails	5.0.7.2	No fix stated
https://github.com/rails/rails	4.2.11.1	No fix stated