Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2018-11627 Medium Severity Vulnerability detected by WhiteSource #4

Closed
mend-bolt-for-github bot opened this issue Feb 28, 2019 · 1 comment
Closed

CVE-2018-11627 Medium Severity Vulnerability detected by WhiteSource #4

mend-bolt-for-github bot opened this issue Feb 28, 2019 · 1 comment
Assignees
@vladzima
Labels
security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-bolt-for-github
Copy link
Contributor

CVE-2018-11627 - Medium Severity Vulnerability

Vulnerable Library - sinatra-1.4.8.gem

Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.

path: /var/lib/gems/2.3.0/cache/sinatra-1.4.8.gem

Library home page: https://rubygems.org/gems/sinatra-1.4.8.gem

Dependency Hierarchy:

  • jekyll-admin-0.8.1.gem (Root Library)
    • ❌ sinatra-1.4.8.gem (Vulnerable Library)

Found in HEAD commit: b3959e9cf7e18549f4a5e974ecb62239f3b8eaf2

Vulnerability Details

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

Publish Date: 2018-05-31

URL: CVE-2018-11627

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: sinatra/sinatra@1278686

Release Date: 2018-05-30

Fix Resolution: Replace or update the following file: base.rb

Step up your Open Source Security Game with WhiteSource here
@mend-bolt-for-github mend-bolt-for-github bot added the security vulnerability Security vulnerability detected by WhiteSource label Feb 28, 2019
@vladzima vladzima self-assigned this Feb 28, 2019
@vladzima
Copy link
Owner

Not an issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vladzima vladzima

Labels
security vulnerability Security vulnerability detected by WhiteSource
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@vladzima