{
  "schema_version": "1.4.0",
  "id": "GHSA-rhf2-x48g-5wr7",
  "modified": "2025-04-09T03:53:51Z",
  "published": "2022-05-01T23:44:32Z",
  "aliases": [
    "CVE-2008-1891"
  ],
  "details": "Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.",
  "severity": [],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1891"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41824"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00937.html"
    },
    {
      "type": "WEB",
      "url": "http://aluigi.altervista.org/adv/webrickcgi-adv.txt"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/29794"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30831"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31687"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:140"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:141"
    },
    {
      "type": "WEB",
      "url": "http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/1245/references"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-04-18T22:05:00Z"
  }
}