Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1000119

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

Published

2018-03-07T14:29:00.390

Last Modified

2024-11-21T03:39:41.283

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-203
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sinatrarb rack-protection < 1.5.5 Yes
Application sinatrarb rack-protection 2.0.0 Yes
Application sinatrarb rack-protection 2.0.0 Yes
Application sinatrarb rack-protection 2.0.0 Yes
References