CVE-2013-0262.yml

---
gem: rack
cve: 2013-0262
osvdb: 89938
ghsa: 85r7-w5mv-c849
url: https://nvd.nist.gov/vuln/detail/CVE-2013-0262
title: "CVE-2013-0262 rubygem-rack: Path sanitization information disclosure"
date: 2013-02-07
description: |
  rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before
  1.4.5 allows attackers to access arbitrary files outside the intended root directory
  via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability
  that is remotely exploitable, aka "symlink path traversals."
cvss_v2: 4.3
patched_versions:
  - "~> 1.4.5"
  - ">= 1.5.2"