01 Record

CVE-2019-18978

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 2.46% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 84.0% of scored records. A rank, not a probability.
NVD base score: 5.3 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-11-14 20:21Z6 YR AGO

Last updated

2024-08-05 02:02Z2 YR AGO

Reserved

2019-11-14

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base

Data version

5.1

Document digest

7a251573ca56029824a6321bcdc5bccb2a22bc6d98b0bf90e43ca5a7e2de2f4d

05 Affected products

VendorProductVersionsPlatforms

canonicalubuntu_linuxNot specified—

debiandebian_linuxNot specified—

rack-cors_projectrack-corsNot specified—

06 References

github.comhttps://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17dx_refsource_MISC
github.comhttps://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4x_refsource_MISC
lists.debian.org[debian-lts-announce] 20200206 [SECURITY] [DLA 2096-1] ruby-rack-cors security updatehttps://lists.debian.org/debian-lts-announce/2020/02/msg00004.htmlmailing-listx_refsource_MLIST
lists.debian.org[debian-lts-announce] 20201001 [SECURITY] [DLA 2389-1] ruby-rack-cors security updatehttps://lists.debian.org/debian-lts-announce/2020/10/msg00000.htmlmailing-listx_refsource_MLIST
usn.ubuntu.comUSN-4571-1https://usn.ubuntu.com/4571-1/vendor-advisoryx_refsource_UBUNTU
www.debian.orgDSA-4918https://www.debian.org/security/2021/dsa-4918vendor-advisoryx_refsource_DEBIAN

07 Fixed in

Debian 12

ruby-rack-cors
Fixed in 1.1.1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

ruby-rack-cors
Fixed in 1.1.1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

ruby-rack-cors
Fixed in 1.1.1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 16.04 LTS

ruby-rack-cors
Fixed in 0.4.0-1+deb9u2build0.16.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

ruby-rack-cors
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.