{"action":"Upgrade rack-cors to 1.0.4 or later.","affected":[{"fixed":"1.0.4","introduced":"0"}],"component":"rack-cors","cve_ids":["CVE-2019-18978"],"ecosystem":"RubyGems","epss":0.02462,"exploited":false,"fixed_versions":["1.0.4"],"ghsa_id":"GHSA-pf8f-w267-mq2h","id":"tcs_01M5KEMJ7DP3CRNSMK1FKGVW4J","modified_at":"2024-02-16T08:21:36.004949Z","published_at":"2019-11-15T20:26:59Z","references":["https://osv.dev/vulnerability/GHSA-pf8f-w267-mq2h","https://nvd.nist.gov/vuln/detail/CVE-2019-18978","https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d","https://github.com/cyu/rack-cors","https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4","https://lists.debian.org/debian-lts-announce/2020/02/msg00004.html","https://lists.debian.org/debian-lts-announce/2020/10/msg00000.html","https://usn.ubuntu.com/4571-1","https://www.debian.org/security/2021/dsa-4918"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-pf8f-w267-mq2h","url":"https://osv.dev/vulnerability/GHSA-pf8f-w267-mq2h"}],"summary":"The rack-cors rubygem may allow directory traveral"}