{"api_version":"1","generated_at":"2026-07-23T07:18:16+00:00","cve":"CVE-2014-7819","urls":{"html":"https://cve.report/CVE-2014-7819","api":"https://cve.report/api/cve/CVE-2014-7819.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-7819","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-7819"},"summary":{"title":"CVE-2014-7819","description":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","state":"PUBLISHED","assigner":"redhat","published_at":"2014-11-08 11:55:03","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-22","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html","name":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"openSUSE-SU-2014:1514-1: moderate: Security update for rubygem-sprockets","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html","name":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"openSUSE-SU-2014:1513-1: moderate: Security update for rubygem-sprockets","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wQBeGXqGs3E/JqUMB6fhh3gJ","name":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wQBeGXqGs3E/JqUMB6fhh3gJ","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"","mime":"text/x-ruby","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html","name":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"openSUSE-SU-2014:1504-1: moderate: Security update for rubygem-sprockets","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html","name":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"openSUSE-SU-2014:1502-1: moderate: Security update for rubygem-sprockets","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/doAVp0YaTqY/aHFngBqNBoAJ","name":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/doAVp0YaTqY/aHFngBqNBoAJ","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHBA-2015:1100","name":"MISC:https://access.redhat.com/errata/RHBA-2015:1100","refsource":"MITRE","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/security/cve/CVE-2014-7819","name":"MISC:https://access.redhat.com/security/cve/CVE-2014-7819","refsource":"MITRE","tags":[],"title":"CVE-2014-7819 - Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161527","name":"MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1161527","refsource":"MITRE","tags":[],"title":"1161527 – (CVE-2014-7819) CVE-2014-7819 rubygem-sprockets: arbitrary file existence disclosure","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY","name":"MISC:https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY","refsource":"MITRE","tags":[],"title":"Google Groups","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7819","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7819","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"7819","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sprockets_project","cpe5":"sprockets","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:03:27.170Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"openSUSE-SU-2014:1504","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html"},{"name":"openSUSE-SU-2014:1514","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html"},{"name":"[rubyonrails-security] 20141030 [AMENDED] [CVE-2014-7819] Arbitrary file existence disclosure in Sprockets","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/doAVp0YaTqY/aHFngBqNBoAJ"},{"name":"openSUSE-SU-2014:1502","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html"},{"name":"openSUSE-SU-2014:1513","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html"},{"name":"[rubyonrails-security] 20141030 Arbitrary file existence disclosure in Sprockets (CVE-2014-7819)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wQBeGXqGs3E/JqUMB6fhh3gJ"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-10-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-12-01T15:57:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"openSUSE-SU-2014:1504","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html"},{"name":"openSUSE-SU-2014:1514","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html"},{"name":"[rubyonrails-security] 20141030 [AMENDED] [CVE-2014-7819] Arbitrary file existence disclosure in Sprockets","tags":["mailing-list","x_refsource_MLIST"],"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/doAVp0YaTqY/aHFngBqNBoAJ"},{"name":"openSUSE-SU-2014:1502","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html"},{"name":"openSUSE-SU-2014:1513","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html"},{"name":"[rubyonrails-security] 20141030 Arbitrary file existence disclosure in Sprockets (CVE-2014-7819)","tags":["mailing-list","x_refsource_MLIST"],"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wQBeGXqGs3E/JqUMB6fhh3gJ"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2014-7819","datePublished":"2014-11-08T11:00:00.000Z","dateReserved":"2014-10-03T00:00:00.000Z","dateUpdated":"2024-08-06T13:03:27.170Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-11-08 11:55:03","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-22","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.5","matchCriteriaId":"36F5A38C-B51C-4455-80B2-3FA89022C72B"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.1.0","versionEndExcluding":"2.1.4","matchCriteriaId":"B8177C76-1C51-41E2-9647-107A76D9A9C0"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.2.0","versionEndExcluding":"2.2.3","matchCriteriaId":"328E446A-05ED-4B23-9027-BC43A529C1AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.3.0","versionEndExcluding":"2.3.3","matchCriteriaId":"659F0437-C16E-422C-89A8-448EDA78F48E"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.4.0","versionEndExcluding":"2.4.6","matchCriteriaId":"02AFF247-E71C-4C01-AB2A-EAF1CF171AC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndExcluding":"2.5.1","matchCriteriaId":"50BAFDB7-A9B8-42E7-BC49-0D38DBC1E527"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.7.0","versionEndExcluding":"2.7.1","matchCriteriaId":"DDDE474C-2C05-4D15-B24F-82635B7FD896"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.8.0","versionEndExcluding":"2.8.3","matchCriteriaId":"4D4C63A3-F044-49CD-8D72-D8614C359250"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.9.0","versionEndExcluding":"2.9.4","matchCriteriaId":"7774FEE9-5ED9-4976-B363-38D838B8BA57"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.10.0","versionEndExcluding":"2.10.2","matchCriteriaId":"7660A259-00F1-4CB6-AAE6-85D769DB4A64"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.11.0","versionEndExcluding":"2.11.3","matchCriteriaId":"70228E9F-071E-45B6-9FBA-FE85DB04806E"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*","versionStartIncluding":"2.12.0","versionEndExcluding":"2.12.3","matchCriteriaId":"EA983B03-4446-4FE4-8EC7-DAFC9498CE6D"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:2.6.0:*:*:*:*:*:*:*","matchCriteriaId":"8632528E-DF46-47BC-A229-E773D0CA4EC3"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:3.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"E99F6172-6BF6-4FD1-BA63-1A9A0244FBD9"},{"vulnerable":true,"criteria":"cpe:2.3:a:sprockets_project:sprockets:3.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"84D71F8E-38B6-4E96-B745-3D19DC64504D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"7819","Ordinal":"1","Title":"CVE-2014-7819","CVE":"CVE-2014-7819","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"7819","Ordinal":"1","NoteData":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","Type":"Description","Title":"CVE-2014-7819"},{"CveYear":"2014","CveId":"7819","Ordinal":"2","NoteData":"2014-11-08","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"7819","Ordinal":"3","NoteData":"2014-12-01","Type":"Other","Title":"Modified"}]}}}