CVE-2018-3760CWE-22

There is an information leak vulnerability in Sprockets

published June 26, 2018

CVSS
—
EPSS
27%
Percentile
98.0
In the wild
Unconfirmed
What it is

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.26717 · 98.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2018-06-26T19:00Z
EPSS history
Timeline
  • 22 SEP 03:16Z
    EPSS moved 27% → 16%
    epss
  • 06 SEP 03:12Z
    EPSS moved 27% → 16%
    epss
  • 30 AUG 16:01Z
    EPSS moved 16% → 27%
    epss
  • 29 AUG 04:39Z
    EPSS moved 27% → 16%
    epss
  • 26 JUN 19:00Z
    There is an information leak vulnerability in Sprockets
    cvelistv5