swagger-api / swagger-api/swagger-codegen

Description

WS-2017-0276 - High Severity Vulnerability

Vulnerable Library - rack-protection-1.5.3.gem

You should use protection!

Library home page: https://rubygems.org/gems/rack-protection-1.5.3.gem

Dependency Hierarchy:

• sinatra-1.4.6.gem (Root Library)
  • ❌ rack-protection-1.5.3.gem (Vulnerable Library)

Found in HEAD commit: 4b7a8d7d7384aa6a27d6309c35ade0916edae7ed

Found in base branch: master

Vulnerability Details

Affected versions of the rack-protection package (before 2.0.0.beta1), are vulnerable to CSRF attacks.

Publish Date: 2016-08-17

URL: WS-2017-0276

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2016-08-17

Fix Resolution: 2.0.0.beta1

Contributor guide

Open the contributing guide

First steps

1. Read the whole issue, then the project's contributing guide.
2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
3. Fork the repository and make your change on a branch.
4. Open a pull request that references the issue number.

Research direction

Assessment

Tech stack

ruby

Domain

security

Issue type

Bug

Difficulty

2/5

Estimated time

1-3 hours

Activity status

Stale

Clarity

Mostly clear

Newbie friendliness

35/100