CVE-2014-7819 (Medium) detected in sprockets-2.11.0.gem

[mend-bolt-for-github]

CVE-2014-7819 - Medium Severity Vulnerability

Vulnerable Library - sprockets-2.11.0.gem

Sprockets is a Rack-based asset packaging system that concatenates and serves JavaScript, CoffeeScript, CSS, LESS, Sass, and SCSS.

Library home page: http://rubygems.org/gems/sprockets-2.11.0.gem

Path to dependency file: /tmp/ws-scm/app1/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/sprockets-2.11.0.gem

Dependency Hierarchy:

• sass-rails-4.0.3.gem (Root Library)
  • ❌ sprockets-2.11.0.gem (Vulnerable Library)

Found in HEAD commit: 9d946faa10e3050193fb56220287f7565773de83

Vulnerability Details

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Publish Date: 2014-11-08

URL: CVE-2014-7819

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-7819

Release Date: 2014-11-08

Fix Resolution: 2.0.5,2.1.4,2.2.3,2.3.3,2.4.6,2.5.1,2.7.1,2.8.3,2.9.4,2.10.2,2.11.3,2.12.3,3.0.0.beta.3