Closed mend-bolt-for-github[bot] closed 4 years ago
Middleware that will make Rack-based apps CORS compatible. Fork the project here: https://github.com/cyu/rack-cors
Library home page: https://rubygems.org/gems/rack-cors-1.0.3.gem
Dependency Hierarchy: - :x: **rack-cors-1.0.3.gem** (Vulnerable Library)
Found in HEAD commit: e8aa1b3e0f79399ea66767ed9ce2ffeb0b8e7f45
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Publish Date: 2019-11-14
URL: CVE-2019-18978
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18978
Release Date: 2019-11-14
Fix Resolution: v1.0.4
Step up your Open Source Security Game with WhiteSource here
CVE-2019-18978 - Medium Severity Vulnerability
Middleware that will make Rack-based apps CORS compatible. Fork the project here: https://github.com/cyu/rack-cors
Library home page: https://rubygems.org/gems/rack-cors-1.0.3.gem
Dependency Hierarchy: - :x: **rack-cors-1.0.3.gem** (Vulnerable Library)
Found in HEAD commit: e8aa1b3e0f79399ea66767ed9ce2ffeb0b8e7f45
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Publish Date: 2019-11-14
URL: CVE-2019-18978
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18978
Release Date: 2019-11-14
Fix Resolution: v1.0.4
Step up your Open Source Security Game with WhiteSource here