CVE-2018-3760

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22 CWE-200

Affected software

Vendor	Product	Versions
HackerOne	Sprockets	4.0.0.beta8, 3.7.2, 2.12.5

References

https://access.redhat.com/errata/RHSA-2018:2244Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2245Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2561Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2745Third Party Advisory
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5Broken Link
https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJPatch, Third Party Advisory
https://www.debian.org/security/2018/dsa-4242Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2244Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2245Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2561Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2745Third Party Advisory
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5Broken Link
https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJPatch, Third Party Advisory
https://www.debian.org/security/2018/dsa-4242Third Party Advisory

Timeline

Published: Jun 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-37618.1Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allow CVE-2018-37624.3Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still r CVE-2018-37634.8In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS CVE-2018-37644.8In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring CVE-2018-37667.5Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server.CVE-2018-37679.1`memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.CVE-2018-37696.1ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.CVE-2018-37705.5A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the loc CVE-2018-37716.1An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browse CVE-2018-37729.8Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` mo CVE-2018-37736.1There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.CVE-2018-377410.0Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Aut