CVE-2018-11627: XSS
It was found that Sinatra is vulnerable to an XSS via the 400 Bad Request page that occurs upon a params parser exception.
Upstream issue:
https://github.com/sinatra/sinatra/issues/1428
Introduced by:
https://github.com/sinatra/sinatra/commit/8f8df53ff29938ace79b31097c27d9cdac803b44
Upstream patch:
https://github.com/sinatra/sinatra/commit/12786867d6faaceaec62c7c2cb5b0e2dc074d71a
Other sources
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-11627?
The severity of CVE-2018-11627 is medium.
How can an attacker exploit CVE-2018-11627?
An attacker can exploit CVE-2018-11627 by injecting malicious code through a specially crafted request, leading to cross-site scripting (XSS) attacks.
What is the affected software of CVE-2018-11627?
The affected software of CVE-2018-11627 includes Sinatra versions before 2.0.2, Redhat Cloudforms versions 4.6 and 4.7.
What is the remedy for CVE-2018-11627?
To remediate CVE-2018-11627, upgrade to Sinatra version 2.0.2 or later.
Where can I find more information about CVE-2018-11627?
You can find more information about CVE-2018-11627 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-11627), [GitHub Issue](https://github.com/sinatra/sinatra/issues/1428), [GitHub Commit](https://github.com/sinatra/sinatra/commit/12786867d6faaceaec62c7c2cb5b0e2dc074d71a).