Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
RubyGems 路径遍历漏洞
Vulnerability Description
RubyGems是RubyGems组织的一款Ruby程序包管理器，它主要用于发布和管理Ruby程序包。 RubyGems中的package.rb文件的‘install_location’函数存在目录遍历漏洞，该漏洞源于程序没有正确的验证用户的请求。攻击者可通过发送带有‘..’序列的特制URL请求利用该漏洞查看系统上的任意文件。以下版本受到影响：RubyGems 2.2.9版本，2.3.6版本，2.4.3版本，2.5.0版本。
CVSS Information
N/A
Vulnerability Type
N/A