{"action":"Upgrade sprockets to 2.12.5 or later.","affected":[{"fixed":"3.7.2","introduced":"3.0.0"},{"fixed":"4.0.0.beta8","introduced":"4.0.0.beta1"},{"fixed":"2.12.5","introduced":"0"}],"component":"sprockets","cve_ids":["CVE-2018-3760"],"ecosystem":"RubyGems","epss":0.26717,"exploited":false,"fixed_versions":["3.7.2","4.0.0.beta8","2.12.5"],"ghsa_id":"GHSA-pr3h-jjhj-573x","id":"tcs_01M5KEMPC2ZVY66NR9ZGV00KQQ","modified_at":"2024-02-16T08:29:28.891397Z","published_at":"2018-06-20T22:18:58Z","references":["https://osv.dev/vulnerability/GHSA-pr3h-jjhj-573x","https://nvd.nist.gov/vuln/detail/CVE-2018-3760","https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5","https://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441","https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5f","https://access.redhat.com/errata/RHSA-2018:2244","https://access.redhat.com/errata/RHSA-2018:2245","https://access.redhat.com/errata/RHSA-2018:2561","https://access.redhat.com/errata/RHSA-2018:2745","https://github.com/rails/sprockets","https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ","https://www.debian.org/security/2018/dsa-4242"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-pr3h-jjhj-573x","url":"https://osv.dev/vulnerability/GHSA-pr3h-jjhj-573x"}],"summary":"Sprockets path traversal leads to information leak"}