Arbitrary file existence disclosure in Action Pack (CVE-2014-7818)(groups.google.com)

4 pointsby bensedat12 yıl önce1 comments

groups.google.com

Arbitrary file existence disclosure in Action Pack (CVE-2014-7818)

https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo

1 comments

Wow, this is trivial to exploit -- I recommend people apply the patches immediately. You can't leak file contents, but it's otherwise a fairly standard path traversal attack.