Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x
    before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded
    sequences (".%252e"). (CVE-2007-6612)

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.3.  Mac OS X 10.5.3 contains security fixes for a number of programs.

ID	Name	Product	Family	Severity
433811	SCA: security update for mongrel (GHSA-m7r6-43v2-49vf)	Tenable Cloud Security	SCA Checks	high
433811	SCA: security update for mongrel (GHSA-m7r6-43v2-49vf)	Tenable Self-Hosted Container Security	SCA Checks	high
32478	Mac OS X Multiple Vulnerabilities (Security Update 2008-003)	Nessus	MacOS X Local Security Checks	critical
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
4523	Mac OS X < 10.5.3	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2007-6612

high

Tenable Plugins

high

high

critical

critical

critical