Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJqOWMtOXZtdi03bTM5

Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.

Permalink: https://github.com/advisories/GHSA-2j9c-9vmv-7m39
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJqOWMtOXZtdi03bTM5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 5 years ago
Updated: 7 months ago


CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-2j9c-9vmv-7m39, CVE-2017-11173
References: Repository: https://github.com/cyu/rack-cors

Affected Packages

rubygems:rack-cors
Dependent packages: 80
Dependent repositories: 44,919
Downloads: 160,335,045 total
Affected Version Ranges: < 0.4.1
Fixed in: 0.4.1
All affected versions: 0.1.0, 0.1.1, 0.2.0, 0.2.2, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.3.0, 0.3.1, 0.4.0
All unaffected versions: 0.4.1, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.5, 1.0.6, 1.1.0, 1.1.1, 2.0.0, 2.0.1, 2.0.2