Описание
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| devel | not-affected | 1.1.1-1 |
| disco | ignored | end of life |
| eoan | ignored | end of life |
| esm-apps-legacy/xenial | released | 0.4.0-1+deb9u2build0.16.04.1 |
| esm-apps/bionic | needed | |
| esm-apps/focal | not-affected | 1.1.1-1 |
| esm-apps/jammy | not-affected | 1.1.1-1 |
| esm-apps/noble | not-affected | 1.1.1-1 |
| esm-apps/resolute | not-affected | 1.1.1-1 |
Показывать по
EPSS
5 Medium
CVSS2
5.3 Medium
CVSS3
Связанные уязвимости
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
An issue was discovered in the rack-cors (aka Rack CORS Middleware) ge ...
The rack-cors rubygem may allow directory traveral
Уязвимость программного обеспечения организации совместимости приложений Rack с CORS Rack-cors, связанная с некорректным ограничением имени пути к каталогу, позволяющая нарушителю получить доступ к конфиденциальным данным
ALT-PU-2023-4270: package `gem-rack-cors` update to version 2.0.1.0-alt0.1
EPSS
5 Medium
CVSS2
5.3 Medium
CVSS3