Rack vulnerable to Cross-site Scripting

TRUNG BÌNH 6.1CVE-2018-16471 · GHSA-5r2p-j47h-mhpg · Công bố 13/11/2018 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2018-16471 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng rack, rack (rack project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.9%, cao hơn 79.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.0.6, 1.6.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
rack RubyGems	`≥ 2.0.0, < 2.0.6< 1.6.11`	`2.0.61.6.11`
rack rack_project	`≥ 1.6.0, < 1.6.11≥ 2.0.0, < 2.0.6`	`1.6.112.0.6`

Mô tả

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.

Mô tả của NVD

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.