Summary

Netsparker identified a Ruby on Rails File Content Disclosure (CVE-2019-5418).

Impact

An attacker can read arbitrary files stored on your web server by crafting a malicious Accept header and sending it to your application. These files can contain sensitive data such as passwords, source code or encryption keys.

Additionally attackers may use the gathered data to get access to your web server or applications.

Remediation

We suggest that you update Ruby on Rails to a version > 5.2.1 in order to fix this vulnerability.

Classifications
PCI v3.2-, CAPEC-252, WASC-33, OWASP 2013-A4, OWASP 2017-A5 , CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities

OR

Search Vulnerability

Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

GET A DEMO