circleci-public / circleci-demo-ruby-sinatra Goto Github PK

CVE-2018-11627
high severity
Vulnerable versions: >= 2.0.0, < 2.0.2
Patched version: 2.0.2
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

CVE-2018-7212
moderate severity
Vulnerable versions: = 2.0.0
Patched version: 2.0.1
An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.

CVE-2018-16471
moderate severity
Vulnerable versions: >= 2.0.0, < 2.0.6
Patched version: 2.0.6
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.