CVE-2017-11173
Published: 13 July 2017
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
ruby-rack-cors Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(0.4.1-1)
|
| bionic |
Not vulnerable
(0.4.1-1)
|
|
| cosmic |
Not vulnerable
(0.4.1-1)
|
|
| disco |
Not vulnerable
(0.4.1-1)
|
|
| trusty |
Does not exist
(trusty was needs-triage)
|
|
| upstream |
Released
(0.4.1-1)
|
|
| xenial |
Released
(0.4.0-1+deb9u1build0.16.04.1)
|
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Released
(0.4.0-1+deb9u1build0.17.04.1)
|
|
|
Patches: upstream: https://github.com/cyu/rack-cors/commit/42ebe6caa8e85ffa9c8a171bda668ba1acc7a5e6 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |