Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-5swj-xwsw-rkac

Summary

Directory Traversal Vulnerability With Certain Route Configurations
The implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name. This module does not perform adequate input sanitization which could allow an attacker to use a specially crafted request to retrieve arbitrary files from the RoR application server.

Aliases

alias	CVE-2014-0130

alias	GHSA-6x85-j5j2-27jx

Fixed_packages

url	pkg:gem/actionpack@3.2.18
purl	pkg:gem/actionpack@3.2.18
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.2.18

url	pkg:gem/actionpack@4.0.5
purl	pkg:gem/actionpack@4.0.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.5

url	pkg:gem/actionpack@4.1.1
purl	pkg:gem/actionpack@4.1.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.1

url	pkg:gem/rails@3.2.18
purl	pkg:gem/rails@3.2.18
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.2.18

url	pkg:gem/rails@4.0.5
purl	pkg:gem/rails@4.0.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/rails@4.0.5

url	pkg:gem/rails@4.1.1
purl	pkg:gem/rails@4.1.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/rails@4.1.1

Affected_packages

url pkg:gem/actionpack@3.0.0

purl pkg:gem/actionpack@3.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5swj-xwsw-rkac

vulnerability	VCID-75m1-xqdk-j7f3

vulnerability	VCID-bcwq-ngna-fqhd

vulnerability	VCID-chxq-j9us-cygh

vulnerability	VCID-sw7t-5s3e-vkhx

vulnerability	VCID-t9c8-r3yp-sbde

vulnerability	VCID-vp3u-cexw-57a4

vulnerability	VCID-ypcy-hry9-5fa3

vulnerability	VCID-z21g-8h32-yyf6

resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@3.0.0

url pkg:gem/actionpack@4.0.0

purl pkg:gem/actionpack@4.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2p4p-apst-v3cq

vulnerability	VCID-5swj-xwsw-rkac

vulnerability	VCID-ghj9-vyyr-tub8

vulnerability	VCID-wake-zgkk-vber

resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.0.0

url pkg:gem/actionpack@4.1.0

purl pkg:gem/actionpack@4.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5swj-xwsw-rkac

vulnerability	VCID-vex8-56fk-gqdf

resource_url http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@4.1.0

url pkg:gem/rails@0.0

purl pkg:gem/rails@0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5swj-xwsw-rkac

resource_url http://public2.vulnerablecode.io/packages/pkg:gem/rails@0.0

url pkg:gem/rails@4.1

purl pkg:gem/rails@4.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5swj-xwsw-rkac

resource_url http://public2.vulnerablecode.io/packages/pkg:gem/rails@4.1

References

reference_url	http://osvdb.org/show/osvdb/106704
reference_id
reference_type
scores
url	http://osvdb.org/show/osvdb/106704

reference_url	https://access.redhat.com/errata/RHSA-2014:0510
reference_id
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2014:0510

reference_url	https://access.redhat.com/errata/RHSA-2014:0816
reference_id
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2014:0816

reference_url	https://access.redhat.com/errata/RHSA-2014:1863
reference_id
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2014:1863

reference_url	https://bugzilla.redhat.com/show_bug.cgi?id=1095105
reference_id
reference_type
scores
url	https://bugzilla.redhat.com/show_bug.cgi?id=1095105

reference_url	https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
reference_id
reference_type
scores
url	https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ

reference_url	https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o
reference_id
reference_type
scores
url	https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o

reference_url	https://groups.google.com/forum/#!topic/ruby-security-ann/PyJo7_m-Ehk
reference_id
reference_type
scores
url	https://groups.google.com/forum/#!topic/ruby-security-ann/PyJo7_m-Ehk

reference_url	https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/67244
reference_id
reference_type
scores
url	https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/67244

reference_url	https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
reference_id
reference_type
scores
url	https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf

reference_url	https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ
reference_id
reference_type
scores
url	https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ

reference_url	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130
reference_id
reference_type
scores
url	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0130

reference_url	https://access.redhat.com/security/cve/CVE-2014-0130
reference_id	CVE-2014-0130
reference_type
scores
url	https://access.redhat.com/security/cve/CVE-2014-0130

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2014-0130
reference_id	CVE-2014-0130
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2014-0130

reference_url	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml
reference_id	CVE-2014-0130.YML
reference_type
scores
url	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml

reference_url	https://github.com/advisories/GHSA-6x85-j5j2-27jx
reference_id	GHSA-6x85-j5j2-27jx
reference_type
scores
url	https://github.com/advisories/GHSA-6x85-j5j2-27jx

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	22
name	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5swj-xwsw-rkac

Vulnerability Instance