{"id":"CVE-2018-11627","published":"2018-05-31T19:00:00Z","modified":"2024-08-05T08:17:08Z","title":"Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception","vendor":null,"product":null,"tier":"tail","description":{"text":"Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02159,"percentile":0.82155,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/sinatra/sinatra/issues/1428","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0315","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0212","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://github.com/sinatra/sinatra/commit/12786867d6faaceaec62c7c2cb5b0e2dc074d71a","tags":["x_refsource_MISC"]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":16.43}]},"affected":[{"ecosystem":"RubyGems","package":"sinatra","vulnerableRanges":[">=2.0.0, <2.0.2"],"patched":["2.0.2"],"from":["GHSA-mq35-wqvf-r23c"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0197","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sinatra-cve-2018-11627","children":[{"from":"CVE-2018-11627","to":"CVE-2022-29970","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/sinatra/base.rb"],"commits":["https://github.com/sinatra/sinatra/commit/12786867d6faaceaec62c7c2cb5b0e2dc074d71a","https://github.com/sinatra/sinatra/commit/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2018-7212","published":"2018-02-18","fixed":"2.0.1","kev":false,"link":{"from":"CVE-2018-7212","to":"CVE-2018-11627","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:sinatra","fromFixed":"2.0.1","toFixed":"2.0.2","daysApart":102}]}},{"cve":"CVE-2018-11627","published":"2018-05-31","fixed":"2.0.2","kev":false},{"cve":"CVE-2022-29970","published":"2022-05-02","fixed":"2.2.0","kev":false},{"cve":"CVE-2022-45442","published":"2022-11-28","fixed":"3.0.4","kev":false},{"cve":"CVE-2024-21510","published":"2024-11-01","fixed":"4.1.0","kev":false}],"package":"RubyGems:sinatra"}}