CVE:CVE-2014-0130
CNNVD:CNNVD-201405-091
Ruby on Rails是美国Rails团队的一套基于Ruby语言的开源Web应用框架。
Ruby on Rails 3.2.18之前版本、4.0.5之前的4.0.x版本和4.1.1之前的4.1.x版本存在路径遍历漏洞，该漏洞源于当某些路由globbing配置启用，允许远程攻击者通过精心设计的请求读取任意文件。
solution:Upgrade redhat subscription_asset_manager to a higher version than 1.3.0,and avoid the version (,1.3.0]; Upgrade rubyonrails rails to a higher version than 3.2.0,3.2.0:rc1,3.2.0:rc2,3.2.1,3.2.2,3.2.2:rc1,3.2.3,3.2.3:rc1,3.2.3:rc2,3.2.4,3.2.4:rc1,3.2.5,3.2.6,3.2.7,3.2.8,3.2.9,3.2.10,3.2.11,3.2.12,3.2.13:rc1,3.2.13:rc2,3.2.15:rc3,3.2.16,4.0.0,4.0.0:beta,4.0.0:rc1,4.0.0:rc2,4.0.1,4.0.1:rc1,4.0.1:rc2,4.0.1:rc3,4.0.1:rc4,4.0.2,4.0.3,4.0.4,4.1.0:beta1,and avoid the version 3.2.0,3.2.0:rc1,3.2.0:rc2,3.2.1,3.2.2,3.2.2:rc1,3.2.3,3.2.3:rc1,3.2.3:rc2,3.2.4,3.2.4:rc1,3.2.5,3.2.6,3.2.7,3.2.8,3.2.9,3.2.10,3.2.11,3.2.12,3.2.13:rc1,3.2.13:rc2,3.2.15:rc3,3.2.16,4.0.0,4.0.0:beta,4.0.0:rc1,4.0.0:rc2,4.0.1,4.0.1:rc1,4.0.1:rc2,4.0.1:rc3,4.0.1:rc4,4.0.2,4.0.3,4.0.4,4.1.0:beta1; Upgrade rubyonrails ruby_on_rails to a higher version than 3.2.17,and avoid the version (,3.2.17]