{"action":"Upgrade rack to 1.6.11 or later.","affected":[{"fixed":"2.0.6","introduced":"2.0.0"},{"fixed":"1.6.11","introduced":"0"}],"component":"rack","cve_ids":["CVE-2018-16471"],"ecosystem":"RubyGems","epss":0.0189,"exploited":false,"fixed_versions":["2.0.6","1.6.11"],"ghsa_id":"GHSA-5r2p-j47h-mhpg","id":"tcs_01M5KEH3VQ5WKG6S3XVRQQN66Q","modified_at":"2024-02-18T05:22:09.088480Z","published_at":"2018-11-15T15:59:08Z","references":["https://osv.dev/vulnerability/GHSA-5r2p-j47h-mhpg","https://nvd.nist.gov/vuln/detail/CVE-2018-16471","https://github.com/rack/rack","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16471.yml","https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o","https://groups.google.com/forum/#!topic/rubyonrails-security/GKsAFT924Ag","https://lists.debian.org/debian-lts-announce/2018/11/msg00022.html","https://usn.ubuntu.com/4089-1","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-5r2p-j47h-mhpg","url":"https://osv.dev/vulnerability/GHSA-5r2p-j47h-mhpg"}],"summary":"Rack vulnerable to Cross-site Scripting"}