Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-35rt-t6e1-pfa6
Vulnerability ID VCID-35rt-t6e1-pfa6
Aliases CVE-2014-0130
GHSA-6x85-j5j2-27jx
Summary Directory Traversal Vulnerability With Certain Route Configurations The implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name. This module does not perform adequate input sanitization which could allow an attacker to use a specially crafted request to retrieve arbitrary files from the RoR application server.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
cvssv3.1 7.5 http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
generic_textual HIGH http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
ssvc Attend http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
cvssv3.1 7.5 http://rhn.redhat.com/errata/RHSA-2014-1863.html
cvssv3.1 7.5 http://rhn.redhat.com/errata/RHSA-2014-1863.html
generic_textual HIGH http://rhn.redhat.com/errata/RHSA-2014-1863.html
ssvc Attend http://rhn.redhat.com/errata/RHSA-2014-1863.html
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2014:0510
generic_textual HIGH https://access.redhat.com/errata/RHSA-2014:0510
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2014:0816
generic_textual HIGH https://access.redhat.com/errata/RHSA-2014:0816
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2014:1863
generic_textual HIGH https://access.redhat.com/errata/RHSA-2014:1863
cvssv3.1 7.5 https://access.redhat.com/security/cve/CVE-2014-0130
generic_textual HIGH https://access.redhat.com/security/cve/CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.45374 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.50682 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.5271 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
epss 0.5271 https://api.first.org/data/v1/epss?cve=CVE-2014-0130
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=1095105
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=1095105
cvssv2 5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-6x85-j5j2-27jx
cvssv3.1 7.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml
cvssv3.1 7.5 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
cvssv3.1 7.5 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
generic_textual HIGH https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
ssvc Attend https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
cvssv3 7.5 https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
cvssv3.1 7.5 https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
generic_textual HIGH https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2014-0130
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2014-0130
cvssv3.1 7.5 https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/67244
generic_textual HIGH https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/67244
cvssv3.1 7.5 https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
generic_textual HIGH https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
cvssv3.1 7.5 https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
generic_textual HIGH https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
cvssv3.1 7.5 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130
generic_textual HIGH https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130
cvssv3.1 7.5 http://www.securityfocus.com/bid/67244
ssvc Attend http://www.securityfocus.com/bid/67244
Reference id Reference type URL
http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
http://osvdb.org/show/osvdb/106704
http://rhn.redhat.com/errata/RHSA-2014-1863.html
https://access.redhat.com/errata/RHSA-2014:0510
https://access.redhat.com/errata/RHSA-2014:0816
https://access.redhat.com/errata/RHSA-2014:1863
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0130.json
https://api.first.org/data/v1/epss?cve=CVE-2014-0130
https://bugzilla.redhat.com/show_bug.cgi?id=1095105
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0081
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0082
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
https://groups.google.com/forum/#!topic/ruby-security-ann/PyJo7_m-Ehk
https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/67244
https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130
67244 http://www.securityfocus.com/bid/67244
CVE-2014-0130 https://access.redhat.com/security/cve/CVE-2014-0130
CVE-2014-0130 https://nvd.nist.gov/vuln/detail/CVE-2014-0130
CVE-2014-0130.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml
GHSA-6x85-j5j2-27jx https://github.com/advisories/GHSA-6x85-j5j2-27jx
Data source KEV
Date added March 25, 2022
Description Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.
Required action Apply updates per vendor instructions.
Due date April 15, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2014-0130
Ransomware campaign use Unknown
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:25:09Z/ Found at http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://rhn.redhat.com/errata/RHSA-2014-1863.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at http://rhn.redhat.com/errata/RHSA-2014-1863.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:25:09Z/ Found at http://rhn.redhat.com/errata/RHSA-2014-1863.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://access.redhat.com/errata/RHSA-2014:0510
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://access.redhat.com/errata/RHSA-2014:0816
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://access.redhat.com/errata/RHSA-2014:1863
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://access.redhat.com/security/cve/CVE-2014-0130
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1095105
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:25:09Z/ Found at https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://nvd.nist.gov/vuln/detail/CVE-2014-0130
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/67244
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H Found at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.securityfocus.com/bid/67244
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T13:25:09Z/ Found at http://www.securityfocus.com/bid/67244
Exploit Prediction Scoring System (EPSS)
Percentile 0.97583
EPSS Score 0.45374
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:46:52.779133+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rails/CVE-2014-0130.yml 38.0.0