System	Score	Found at
cvssv2		https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionview/CVE-2016-0752.yml
cvssv3.1		https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionview/CVE-2016-0752.yml

Reference id	Reference type	URL
		https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
		https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
		https://web.archive.org/web/20210618005620/https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
		https://web.archive.org/web/20210621170450/http://www.securityfocus.com/bid/81801
		https://web.archive.org/web/20210723192420/http://www.securitytracker.com/id/1034816
		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752
		https://www.exploit-db.com/exploits/40561
CVE-2016-0752		https://nvd.nist.gov/vuln/detail/CVE-2016-0752
CVE-2016-0752.YML		https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0752.yml
CVE-2016-0752.YML		https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-0752.yml
GHSA-xrr4-p6fq-hjg7		https://github.com/advisories/GHSA-xrr4-p6fq-hjg7

Data source	KEV
Date added	March 25, 2022
Description	Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
Required action	Apply updates per vendor instructions.
Due date	April 15, 2022
Note	https://nvd.nist.gov/vuln/detail/CVE-2016-0752
Ransomware campaign use	Unknown

Data source	Metasploit
Description	This module exploits a remote code execution vulnerability in the explicit render method when leveraging user parameters. This module has been tested across multiple versions of Ruby on Rails. The technique used by this module requires the specified endpoint to be using dynamic render paths, such as the following example: def show render params[:id] end Also, the vulnerable target will need a POST endpoint for the TempFile upload, this can literally be any endpoint. This module doesnt use the log inclusion method of exploitation due to it not being universal enough. Instead, a new code injection technique was found and used whereby an attacker can upload temporary image files against any POST endpoint and use them for the inclusion attack. Finally, you only get one shot at this if you are testing with the builtin rails server, use caution.
Note	Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects
Ransomware campaign use	Unknown
Source publication date	Oct. 16, 2016
Platform	BSD,Linux
Source URL	https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb

Data source	Exploit-DB
Date added	Oct. 17, 2016
Description	Ruby on Rails - Dynamic Render File Upload / Remote Code Execution (Metasploit)
Ransomware campaign use	Known
Source publication date	Oct. 17, 2016
Exploit type	remote
Platform	multiple
Source update date	Oct. 25, 2016

Data source	KEV
Date added	March 25, 2022
Description	Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
Required action	Apply updates per vendor instructions.
Due date	April 15, 2022
Note	https://nvd.nist.gov/vuln/detail/CVE-2016-0752
Ransomware campaign use	Unknown

Data source	Metasploit
Description	This module exploits a remote code execution vulnerability in the explicit render method when leveraging user parameters. This module has been tested across multiple versions of Ruby on Rails. The technique used by this module requires the specified endpoint to be using dynamic render paths, such as the following example: def show render params[:id] end Also, the vulnerable target will need a POST endpoint for the TempFile upload, this can literally be any endpoint. This module doesnt use the log inclusion method of exploitation due to it not being universal enough. Instead, a new code injection technique was found and used whereby an attacker can upload temporary image files against any POST endpoint and use them for the inclusion attack. Finally, you only get one shot at this if you are testing with the builtin rails server, use caution.
Note	Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects
Ransomware campaign use	Unknown
Source publication date	Oct. 16, 2016
Platform	BSD,Linux
Source URL	https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb

Data source	Exploit-DB
Date added	Oct. 17, 2016
Description	Ruby on Rails - Dynamic Render File Upload / Remote Code Execution (Metasploit)
Ransomware campaign use	Known
Source publication date	Oct. 17, 2016
Exploit type	remote
Platform	multiple
Source update date	Oct. 25, 2016

No EPSS data available for this advisory.

Patch URL
There are no known patches.

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionview/CVE-2016-0752.yml

Exploitability (E)	Access Vector (AV)	Access Complexity (AC)	Authentication (Au)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
high functional unproven proof_of_concept not_defined	local adjacent_network network	high medium low	multiple single none	none partial complete	none partial complete	none partial complete

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionview/CVE-2016-0752.yml

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none