Detections
Analytics
Rails Config File Detected
high Web App Scanning Plugin ID 114779
Synopsis
Rails Config File DetectedDescription
A Ruby on Rails configuration file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.Solution
Restrict access to the config file or locate it outside the public webroot where possible.See Also
Plugin Details
Severity: High
ID: 114779
Type: remote
Family: Data Exposure
Published: 4/29/2025
Updated: 4/29/2025
Scan Template: api, basic, full, pci, scan
Risk Information
CVSS v2
Risk Factor: High
Base Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: Tenable
CVSS v3
Risk Factor: High
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Score Source: Tenable
CVSS v4
Risk Factor: High
Base Score: 8.7
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score Source: Tenable
Vulnerability Information
CPE: cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
Reference Information
OWASP: 2010-A6, 2013-A5, 2017-A6, 2021-A1, 2021-A5
WASC: Application Misconfiguration, Predictable Resource Location
CAPEC: 95
DISA STIG: APSC-DV-002480
HIPAA: 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3
OWASP API: 2019-API3, 2019-API7, 2023-API3, 2023-API8
PCI-DSS: 3.2-2.2