{"id":"CVE-2020-8161","published":"2020-07-02T00:00:00Z","modified":"2024-08-04T09:48:25Z","title":"A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal…","vendor":null,"product":null,"tier":"tail","description":{"text":"A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03359,"percentile":0.88632,"provenance":"source"},"cwes":[{"id":"CWE-548","name":"Exposure of Information Through Directory Listing"}],"references":[{"url":"https://hackerone.com/reports/434404","tags":[]},{"url":"https://groups.google.com/g/rubyonrails-security/c/IOO1vNZTzPA","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html","tags":["mailing-list"]},{"url":"https://usn.ubuntu.com/4561-1/","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html","tags":["mailing-list"]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":17.73}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rack/rack","versions":["Fixed in 2.1.3, >= 2.2.0"]}],"affected":[{"ecosystem":"RubyGems","package":"rack","vulnerableRanges":["<2.1.3"],"patched":["2.1.3"],"from":["GHSA-5f9h-9pjv-v6j7"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0537","exploited":false,"provenance":"source"}}