What is the CVSS score of CVE-2012-2139?

CVE-2012-2139 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 3.5%.

Is there a public PoC exploit available for CVE-2012-2139?

Yes, a public proof-of-concept exploit is available for CVE-2012-2139. Prioritise patching immediately. EPSS: 3.5%.

Is there a patch available for CVE-2012-2139?

Yes, a patch is available for CVE-2012-2139. Update the affected software to the latest version immediately.

Mail Gem CVE-2012-2139

MEDIUM

Path Traversal (CWE-22)

2012-07-18 secalert@redhat.com

Path Traversal Mail Gem

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jul 18, 2012 - 18:55 cve.org

MEDIUM 5.0

DescriptionCVE.org

AnalysisAI

Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter. Affected products include: Rubygems Mail Gem. Version information: before 2.4.4.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.