CVE-2014-7818 describes a directory traversal vulnerability in Action Pack, a component of Ruby on Rails versions 3.x, 4.0.x, 4.1.x, and 4.2.x beta, specifically when static asset serving is enabled. This flaw allows remote attackers to determine the existence of files outside the application's root directory by manipulating URLs with a “/..%2F” sequence. The vulnerability has a CVSS score of 4.3, indicating medium attack complexity and potential for partial confidentiality impact, but no integrity or availability impact. There is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and limited community discussion or media coverage, suggesting low current exploitability and attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0.0CPE matchmatch criteria | cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:* | ||
3.0.0CPE matchmatch criteria | cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:* | ||
3.0.0CPE matchmatch criteria | cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:* | ||
3.0.0CPE matchmatch criteria | cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:* | ||
3.0.0CPE matchmatch criteria | cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.