CVE-2017-11173 - CVE House
Back to Database
Status published High CVE-2017-11173

Missing anchor in generated regex for rack-cors before 0.4.1 allows...

Vulnerability Description

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-11173

Credits & Attribution

No credits recorded in the NVD database.

References

More from rack-cors project

View All →
CVE-2019-18978
An issue was discovered in the rack-cors (aka Rack CORS...
Medium 5.3

Affected Vendor

rack-cors project

View all reports →

Affected Software

rack-cors, debian linux
Vulnerable Versions:
0, 9.0

Timeline

Official Publish: July 13th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.