Ruby Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4522)

Description

The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.

Remediation

References

CVE-2012-4522

Related Vulnerabilities

Oracle Database Server CVE-2015-2599 Vulnerability (CVE-2015-2599)

Oracle HTTP Server Improper Restriction of XML External Entity Reference Vulnerability (CVE-2018-20843)

Lighttpd Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2008-4359)

WordPress Plugin Sooqr Search Restricted File Upload (1.1.4)

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33327)

Severity

Medium

Classification

CVE-2012-4522 CWE-264