CVE-2017-11173
1 advisory.
RubyGems/rack-cors CVE-2017-11173: high 8.8, EPSS 2.34%
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request
Action: Upgrade rack-cors to 0.4.1 or later.
bundle update rack-corsAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.4.1 | - |
Fixed versions
| 0.4.1 |
Sources
- osv: GHSA-2j9c-9vmv-7m39
- https://nvd.nist.gov/vuln/detail/CVE-2017-11173
- https://github.com/cyu/rack-cors/commit/42ebe6caa8e85ffa9c8a171bda668ba1acc7a5e6
- https://github.com/cyu/rack-cors
- https://packetstormsecurity.com/files/143345/rack-cors-Missing-Anchor.html
- http://seclists.org/fulldisclosure/2017/Jul/22
- http://www.debian.org/security/2017/dsa-3931
CVE-2017-11173 · published · modified · JSON