CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2019-03-27
Ruby on Rails Action View Arbitrary File Content Disclosure Vulnerability (CVE-2019-5418) Analysis and Mitigation Guide
[Affected Scope] Ruby on Rails Action View versions prior to 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1, and all v3 versions
[Impact] Unauthenticated remote attackers can exploit specially crafted Accept headers to read arbitrary files from the target system's filesystem, leading to sensitive data exposure
[Mitigation] Immediately upgrade Ruby on Rails and Action View to the patched versions, or apply temporary web server filtering rules