~ / search / GHSA-mq35-wqvf-r23c

GHSA-mq35-wqvf-r23c

Sinatra Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-11627

Packages

EcosystemPackageAffectedFixed in
RubyGems sinatra >= 2.0.0, < 2.0.2 2.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

References

External links from the advisory. They lead to third-party sites.