PT-2019-6072 · Ruby+2 · Rack-Cors+2

Cyu · Published 2019-11-14 · Updated 2024-07-27 · CVE-2019-18978

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions rack-cors versions prior to 1.0.4

Description The issue allows for ../ directory traversal, enabling access to private resources. This is due to the fact that resource matching does not ensure pathnames are in a canonical format. The vulnerability can be exploited by a remote attacker to gain access to confidential data.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2021-2719

ALT-PU-2023-4270

ALT-PU-2024-7816

BDU:2021-04587

CVE-2019-18978

DLA-2096-1

DLA-2389-1

DSA-4918-1

GHSA-PF8F-W267-MQ2H

USN-4571-1

Affected Products

Alt Linux

Ubuntu

Rack-Cors

References · 23

• https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d · Patch
• https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-18978 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18978 · Vendor Advisory
• https://usn.ubuntu.com/4571-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2096-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18978 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4571-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18978 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18978 · Vendor Advisory
• https://debian.org/security/2021/dsa-4918 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2389-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4571-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18978 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pf8f-w267-mq2h · Vendor Advisory