Описание
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| devel | not-affected | 1.1.1-1 |
| disco | ignored | end of life |
| eoan | ignored | end of life |
| esm-apps/bionic | needed | |
| esm-apps/focal | not-affected | 1.1.1-1 |
| esm-apps/jammy | not-affected | 1.1.1-1 |
| esm-apps/noble | not-affected | 1.1.1-1 |
| esm-apps/xenial | released | 0.4.0-1+deb9u2build0.16.04.1 |
| esm-infra-legacy/trusty | DNE |
Показывать по
EPSS
5 Medium
CVSS2
5.3 Medium
CVSS3
Связанные уязвимости
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
An issue was discovered in the rack-cors (aka Rack CORS Middleware) ge ...
The rack-cors rubygem may allow directory traveral
Уязвимость программного обеспечения организации совместимости приложений Rack с CORS Rack-cors, связанная с некорректным ограничением имени пути к каталогу, позволяющая нарушителю получить доступ к конфиденциальным данным
EPSS
5 Medium
CVSS2
5.3 Medium
CVSS3