CVE-2019-18978
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource mat…
Published: 2019-11-14 · CVSS: Unscored
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7