Arbitrary file existence disclosure in Action Pack (CVE-2014-7818)

Posted by bensedat on Thursday October 30, 2014 @02:50PM
from the groups.google.com dept.

https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo

( 1 comment | 4 points | on HN )

Re:Arbitrary file existence disclosure in Action Pack (CVE-2... by ShaneWilton on Thursday October 30, 2014 @03:09PM (#8535110)

Wow, this is trivial to exploit -- I recommend people apply the patches immediately. You can't leak file contents, but it's otherwise a fairly standard path traversal attack.

[ Parent | on HN ]