Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03ODVnLTI4MnEtcHd2eM4AA5gh
Rack CORS Middleware has Insecure File Permissions
rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.
Permalink: https://github.com/advisories/GHSA-785g-282q-pwvxJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03ODVnLTI4MnEtcHd2eM4AA5gh
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 2 months ago
Updated: about 2 months ago
Identifiers: GHSA-785g-282q-pwvx, CVE-2024-27456
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-27456
- https://github.com/cyu/rack-cors/issues/274
- https://github.com/advisories/GHSA-785g-282q-pwvx
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-cors/CVE-2024-27456.yml
- https://github.com/cyu/rack-cors/blob/878063987bd1ca956282dda95697fd821bf24d2e/CHANGELOG.md#changed
Blast Radius: 0.0
Affected Packages
rubygems:rack-cors
Dependent packages: 80Dependent repositories: 44,919
Downloads: 164,190,059 total
Affected Version Ranges: = 2.0.1
Fixed in: 2.0.2
All affected versions: 2.0.1
All unaffected versions: 0.1.0, 0.1.1, 0.2.0, 0.2.2, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.3.0, 0.3.1, 0.4.0, 0.4.1, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.5, 1.0.6, 1.1.0, 1.1.1, 2.0.0, 2.0.2