Description
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Remediation
References
Related Vulnerabilities
WordPress Plugin Contact Form Clean and Simple Cross-Site Scripting (4.4.0)
WordPress Plugin Amazon Product in a Post SQL Injection (3.5.2)
Drupal Exposure of Resource to Wrong Sphere Vulnerability (CVE-2020-13670)
WordPress Plugin VKontakte API Cross-Site Scripting (2.7)
Moodle Uncontrolled Resource Consumption Vulnerability (CVE-2021-20185)