Description (CNA)
There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / https://github.com/rails/actionpack-page_caching | affected v1.2.1 |
CWE
CWE-22
References
- https://groups.google.com/forum/#%21topic/rubyonrails-security/CFRVkEytdP8
- https://lists.debian.org/debian-lts-announce/2021/07/msg00019.html
ADP enrichment
No English description supplied.