CVE-2012-4522

The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attack… (CVE-2012-4522)

Description

The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.

Source: CVELISTV5 NVD

Metrics

Severity

none

48.85

—

no public PoC known

—

—

—

81.5 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

2.2 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2012-11-24 20:00 UTC

CWE

—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

ruby-lang
ruby

References & sources

IDCVE-2012-4522