CVE-2019-18978

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17dPatch, Third Party Advisory
https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00004.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00000.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/4571-1/Third Party Advisory
https://www.debian.org/security/2021/dsa-4918Third Party Advisory
https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17dPatch, Third Party Advisory
https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00004.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00000.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/4571-1/Third Party Advisory
https://www.debian.org/security/2021/dsa-4918Third Party Advisory

Timeline

Published: Nov 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-189797.8Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS director CVE-2019-18985.3A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote att CVE-2019-189807.5On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's o CVE-2019-189819.8Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.CVE-2019-189826.1bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window bec CVE-2019-189859.8Pimcore before 6.2.2 lacks brute force protection for the 2FA token.CVE-2019-189867.5Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns disti CVE-2019-189875.3An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise CVE-2019-189887.0TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' in CVE-2019-189895.4A partial authentication bypass vulnerability exists on Mediatek MT7620N 1.06 devices. The vulnerability allows sending an unencrypted data CVE-2019-18995.3A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire CVE-2019-189905.4A partial authentication bypass vulnerability exists on Realtek RTL8812AR 1.21WW, RTL8196D 1.0.0, RTL8192ER 2.10, and RTL8881AN 1.09 devices