PT-2020-9126 · Unknown · Io.Ratpack:Ratpack-Core

Published 2020-01-27 · Updated 2020-01-29 · CVE-2019-10770

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions io.ratpack:ratpack-core versions 0.9.10 through 1.7.5

Description The issue affects the development mode error handler when an exception message contains untrusted data, allowing for Cross-site Scripting (XSS). This can be exploited when users do not disable development mode in production. The production mode error handler is not vulnerable.

Recommendations For versions 0.9.10 through 1.7.5, update to version 1.7.6 to resolve the issue. As a temporary workaround, ensure that development mode is disabled in production. Avoid using real customer data (i.e., untrusted user input) in development.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10770

GHSA-R2WF-Q3X4-HRV9

SNYK-JAVA-IORATPACK-534882

Affected Products

Io.Ratpack:Ratpack-Core

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JAVA-IORATPACK-534882 · Exploit
• https://osv.dev/vulnerability/GHSA-r2wf-q3x4-hrv9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10770 · Security Note
• https://github.com/ratpack/ratpack/commit/a3cbb13be1527874528c3b99fc33517c0297b6d3 · Note
• https://github.com/ratpack/ratpack/security/advisories/GHSA-r2wf-q3x4-hrv9 · Note