CVEvulnerability
CVE-2017-11173
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-07-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Description
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
Affected configurations
• rack-cors project rack-cors (< 0.4.1)
• debian debian linux 9.0
References
- http://seclists.org/fulldisclosure/2017/Jul/22 Mailing List, Third Party Advisory
- http://www.debian.org/security/2017/dsa-3931 Third Party Advisory
- https://github.com/cyu/rack-cors/commit/42ebe6caa8e85ffa9c8a171bda668ba1acc7a5e6 Patch, Third Party Advisory
- https://packetstormsecurity.com/files/143345/rack-cors-Missing-Anchor.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Jul/22 Mailing List, Third Party Advisory
- http://www.debian.org/security/2017/dsa-3931 Third Party Advisory
- https://github.com/cyu/rack-cors/commit/42ebe6caa8e85ffa9c8a171bda668ba1acc7a5e6 Patch, Third Party Advisory
- https://packetstormsecurity.com/files/143345/rack-cors-Missing-Anchor.html Third Party Advisory, VDB Entry