Wicked gem contains Path traversal vulnerability (GHSA-rprj-g6xc-p5gq)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-4413
Severity: MODERATE · CWE: CWE-22

The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in `controller/concerns/render_redirect.rb`. An attacker can send a specially-crafted URL request containing `%2E%2E%2F` directory traversal sequences to read arbitrary files on the system.

Affected packages:
package: ecosystem: RubyGems
name: wicked
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.1