GitHub Advisoryadvisory · RubyGems
GHSA-mq35-wqvf-r23c Sinatra Cross-site Scripting vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2018-11627
- Ecosystem
- RubyGems
- Packages
- sinatra
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2020-06-16
Affected packages
• RubyGems sinatra: >= 2.0.0, < 2.0.2 → fixed in 2.0.2
Description
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Related
Alias · CVE (1)
- CVE-2018-11627 Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-11627 advisory
- https://github.com/sinatra/sinatra/issues/1428 web
- https://github.com/sinatra/sinatra/commit/12786867d6faaceaec62c7c2cb5b0e2dc074d71a web
- https://access.redhat.com/errata/RHSA-2019:0212 web
- https://access.redhat.com/errata/RHSA-2019:0315 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2018-11627.yml web
- https://github.com/sinatra/sinatra package