{"action":"Upgrade rack-cors to 0.4.1 or later.","affected":[{"fixed":"0.4.1","introduced":"0"}],"component":"rack-cors","cve_ids":["CVE-2017-11173"],"ecosystem":"RubyGems","epss":0.02345,"exploited":false,"fixed_versions":["0.4.1"],"ghsa_id":"GHSA-2j9c-9vmv-7m39","id":"tcs_01M5KEFYPFWV3MJ4NYG0XP6DP4","modified_at":"2024-12-03T06:02:08.526584Z","published_at":"2018-07-31T18:18:39Z","references":["https://osv.dev/vulnerability/GHSA-2j9c-9vmv-7m39","https://nvd.nist.gov/vuln/detail/CVE-2017-11173","https://github.com/cyu/rack-cors/commit/42ebe6caa8e85ffa9c8a171bda668ba1acc7a5e6","https://github.com/cyu/rack-cors","https://packetstormsecurity.com/files/143345/rack-cors-Missing-Anchor.html","http://seclists.org/fulldisclosure/2017/Jul/22","http://www.debian.org/security/2017/dsa-3931"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-2j9c-9vmv-7m39","url":"https://osv.dev/vulnerability/GHSA-2j9c-9vmv-7m39"}],"summary":"Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request"}