Contents

---
engine: ruby
cve: 2008-1891
url: http://aluigi.altervista.org/adv/webrickcgi-adv.txt
title: Directory traversal vulnerability in WEBrick
date: 2008-04-15
description: |
  Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5
  before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0
  before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers
  to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded
  plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space)
  character in the URI, possibly related to the
  WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality
  and the :DocumentRoot option. 
cvss_v2: 5.0
patched_versions:
  - ~> 1.8.5.231
  - ~> 1.8.6.230
  - ~> 1.8.7.22
  - ">= 1.9.0.2"

Version data entries

6 entries across 6 versions & 2 rubygems

Version	Path
bundler-audit-0.7.0.1	data/ruby-advisory-db/rubies/ruby/CVE-2008-1891.yml
bundler-budit-0.6.2	data/ruby-advisory-db/rubies/ruby/CVE-2008-1891.yml
bundler-budit-0.6.1	data/ruby-advisory-db/rubies/ruby/CVE-2008-1891.yml
bundler-audit-0.6.1	data/ruby-advisory-db/rubies/ruby/CVE-2008-1891.yml
bundler-audit-0.6.0	data/ruby-advisory-db/rubies/ruby/CVE-2008-1891.yml
bundler-audit-0.5.0	data/ruby-advisory-db/rubies/ruby/CVE-2008-1891.yml