Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Vulnerability Type
在安全决策中依赖未经信任的输入
Vulnerability Title
Sinatra 安全漏洞
Vulnerability Description
Sinatra是Sinatra开源的一个DSL，用于以最少的努力快速创建Ruby中的web应用程序 Sinatra存在安全漏洞。攻击者利用该漏洞可以通过在标头中插入任意地址来触发开放重定向攻击。
CVSS Information
N/A
Vulnerability Type
N/A