CVE-2018-3760
ruby-sprockets - security update
7.5
HIGH
CVSS 3.1
EPSS 26.7%
Description
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
How to fix CVE-2018-3760
To remediate CVE-2018-3760, upgrade the affected package to a fixed version below.
- —upgrade to 3.7.0-1.1 or later
- —upgrade to 2.12.3-1+deb8u1 or later
- —upgrade to 3.7.0-1+deb9u1 or later
- —upgrade to 3.7.2 or later
Is CVE-2018-3760 being exploited?
Moderate — EPSS is 26.7%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (4)
- from 0, < 3.7.0-1.1
- from 0, < 2.12.3-1+deb8u1
- from 0, < 3.7.0-1+deb9u1
- >= 3.0.0, < 3.7.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |