CVE-2020-8161

HIGH8.6EPSS 0.91%

Directory traversal in Rack::Directory app bundled with Rack

發布日:2020/7/6修改日:2026/4/28

也稱為:GHSA-5f9h-9pjv-v6j7DEBIAN-CVE-2020-8161

描述

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

受影響套件(5)

Debian/ruby-rackfrom 0, < 2.1.1-5
Debian/ruby-rackfrom 0, < 1.5.2-3+deb8u3
Debian/ruby-rackfrom 0, < 1.6.4-4+deb9u2
Debian/ruby-rackfrom 0, < 2.0.6-3+deb10u2
RubyGems/rackfrom 0, < 2.1.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

參考連結(10)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-8161
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-8161
PATCHhttps://github.com/rack/rack
WEBhttps://github.com/rack/rack/commit/dddb7ad18ed79ca6ab06ccc417a169fde451246e
WEBhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8161.yml
WEBhttps://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
WEBhttps://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA
WEBhttps://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
WEBhttps://lists.debian.org/debian-lts-announce/2023/01/msg00038.html
WEBhttps://usn.ubuntu.com/4561-1