CVE-2018-6914: Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and…

Description

Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)10.2% · higher than 96% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

DL

Debian Linux · Debian

7.0; 8.0; 9.0 · source: NVD

EL

Enterprise Linux · Redhat

6.0; 7.0; 7.4; 7.5; 7.6 · source: NVD

RU

Ruby · Ruby-lang

2.2.0 before 2.2.10; 2.3.0 before 2.3.7; 2.4.0 before 2.4.4; 2.5.0 before 2.5.1; 2.6.0 · source: NVD

UL

Ubuntu Linux · Canonical

14.04; 16.04; 17.10 · source: NVD