levyforchh/connect-api-examples

connect-api-examples's Issues

CVE-2020-8161 (High) detected in rack-2.0.6.gem

CVE-2020-8161 - High Severity Vulnerability

Vulnerable Library - rack-2.0.6.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see https://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-2.0.6.gem

Path to dependency file: connect-api-examples/connect-examples/oauth/ruby/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/rack-2.0.6.gem

Dependency Hierarchy:

• sinatra-2.0.5.gem (Root Library)
  • ❌ rack-2.0.6.gem (Vulnerable Library)

Vulnerability Details

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

Publish Date: 2020-07-02

URL: CVE-2020-8161

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/rack/rack/tree/2.2.0

Release Date: 2020-06-01

Fix Resolution: 2.2.0,2.1.3

CVE-2020-8167 (Medium) detected in rails-5.2.4.2.gem

CVE-2020-8167 - Medium Severity Vulnerability

Vulnerable Library - rails-5.2.4.2.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: ms/2.5.0/cache/rails-5.2.4.2.gem

Dependency Hierarchy:

• ❌ rails-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

Publish Date: 2020-06-19

URL: CVE-2020-8167

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://rubygems.org/gems/rails/versions/6.0.3.1

Release Date: 2020-06-01

Fix Resolution: 6.0.3.1,5.2.4.3

CVE-2021-22904 (Medium) detected in actionpack-5.2.4.2.gem

CVE-2021-22904 - Medium Severity Vulnerability

Vulnerable Library - actionpack-5.2.4.2.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/actionpack-5.2.4.2.gem

Dependency Hierarchy:

• coffee-rails-4.2.2.gem (Root Library)
  • railties-5.2.4.2.gem
    • ❌ actionpack-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

There is a possible DoS vulnerability in the Token Authentication logic in actionpack 4.x before 5.2.4.6, 5.2.6, 6.0.3.7, and 6.1.3.2. Impacted code uses authenticate_or_request_with_http_token or authenticate_with_http_token for request authentication.

Publish Date: 2021-01-07

URL: CVE-2021-22904

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: rubysec/ruby-advisory-db@691f9dc

Release Date: 2021-01-07

Fix Resolution: actionpack - 5.2.4.6,5.2.6,6.0.3.7,6.1.3.2

WS-2020-0042 (Medium) detected in acorn-4.0.13.tgz, acorn-3.3.0.tgz

WS-2020-0042 - Medium Severity Vulnerability

Vulnerable Libraries - acorn-4.0.13.tgz, acorn-3.3.0.tgz

acorn-4.0.13.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-4.0.13.tgz

Path to dependency file: /tmp/ws-scm/connect-api-examples/connect-examples/v2/node_orders-payments/package.json

Path to vulnerable library: /tmp/ws-scm/connect-api-examples/connect-examples/v2/node_payment/node_modules/is-expression/node_modules/acorn/package.json,/tmp/ws-scm/connect-api-examples/connect-examples/v2/node_payment/node_modules/is-expression/node_modules/acorn/package.json

Dependency Hierarchy:

• pug-2.0.4.tgz (Root Library)
  • pug-lexer-4.1.0.tgz
    • is-expression-3.0.0.tgz
      • ❌ acorn-4.0.13.tgz (Vulnerable Library)

acorn-3.3.0.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-3.3.0.tgz

Path to dependency file: /tmp/ws-scm/connect-api-examples/connect-examples/v2/node_orders-payments/package.json

Path to vulnerable library: /tmp/ws-scm/connect-api-examples/connect-examples/v2/node_payment/node_modules/acorn/package.json,/tmp/ws-scm/connect-api-examples/connect-examples/v2/node_payment/node_modules/acorn/package.json

Dependency Hierarchy:

• pug-2.0.4.tgz (Root Library)
  • pug-code-gen-2.0.2.tgz
    • with-5.1.1.tgz
      • ❌ acorn-3.3.0.tgz (Vulnerable Library)

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-08

URL: WS-2020-0042

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1488

Release Date: 2020-03-08

Fix Resolution: 7.1.1

CVE-2020-11022 (Medium) detected in jquery-3.3.1.jar, jquery-3.2.1.min.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.3.1.jar, jquery-3.2.1.min.js

jquery-3.3.1.jar

WebJar for jQuery

Library home page: http://webjars.org

Path to dependency file: connect-api-examples/connect-examples/v2/java_payment/pom.xml

Path to vulnerable library: 20200424204917/downloadResource_b99833fe-607e-4da8-9acd-f91fd57e4dd3/20200424211132/jquery-3.3.1.jar

Dependency Hierarchy:

• ❌ jquery-3.3.1.jar (Vulnerable Library)

jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: connect-api-examples/connect-examples/v2/node_orders-payments/node_modules/superagent/docs/tail.html

Path to vulnerable library: connect-api-examples/connect-examples/v2/node_orders-payments/node_modules/superagent/docs/tail.html,connect-api-examples/connect-examples/v2/node_payment/node_modules/superagent/docs/tail.html

Dependency Hierarchy:

• ❌ jquery-3.2.1.min.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

CVE-2020-15169 (Medium) detected in actionview-5.2.4.2.gem

CVE-2020-15169 - Medium Severity Vulnerability

Vulnerable Library - actionview-5.2.4.2.gem

Simple, battle-tested conventions and helpers for building web pages.

Library home page: https://rubygems.org/gems/actionview-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/actionview-5.2.4.2.gem

Dependency Hierarchy:

• coffee-rails-4.2.2.gem (Root Library)
  • railties-5.2.4.2.gem
    • actionpack-5.2.4.2.gem
      • ❌ actionview-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the t and translate helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

Publish Date: 2020-09-11

URL: CVE-2020-15169

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://rubygems.org/gems/actionview/versions/6.0.3.3

Release Date: 2020-07-21

Fix Resolution: 6.0.3.3, 5.2.4.4

CVE-2020-10663 (High) detected in json-2.2.0.gem

CVE-2020-10663 - High Severity Vulnerability

Vulnerable Library - json-2.2.0.gem

This is a JSON implementation as a Ruby extension in C.

Library home page: https://rubygems.org/gems/json-2.2.0.gem

Path to dependency file: connect-api-examples/connect-examples/oauth/ruby/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/json-2.2.0.gem

Dependency Hierarchy:

• square_connect-2.20190313.1.282.gem (Root Library)
  • ❌ json-2.2.0.gem (Vulnerable Library)

Found in HEAD commit: d50fc21f5f1bd74085f9a31371ea7d49fdb5aee9

Vulnerability Details

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Publish Date: 2020-04-28

URL: CVE-2020-10663

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

Release Date: 2020-03-28

Fix Resolution: 2.3.0

CVE-2020-8203 (High) detected in lodash-4.17.15.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: connect-api-examples/connect-examples/v2/node_payment/package.json

Path to vulnerable library: connect-api-examples/connect-examples/v2/node_payment/node_modules/lodash/package.json,connect-api-examples/connect-examples/v2/node_payment/node_modules/lodash/package.json

Dependency Hierarchy:

• pug-2.0.4.tgz (Root Library)
  • pug-code-gen-2.0.2.tgz
    • constantinople-3.1.2.tgz
      • babel-types-6.26.0.tgz
        • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-23

Fix Resolution: lodash - 4.17.19

WS-2020-0070 (High) detected in lodash-4.17.15.tgz

WS-2020-0070 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /tmp/ws-scm/connect-api-examples/connect-examples/v2/node_payment/package.json

Path to vulnerable library: /tmp/ws-scm/connect-api-examples/connect-examples/v2/node_payment/node_modules/lodash/package.json,/tmp/ws-scm/connect-api-examples/connect-examples/v2/node_payment/node_modules/lodash/package.json

Dependency Hierarchy:

• pug-2.0.4.tgz (Root Library)
  • pug-code-gen-2.0.2.tgz
    • constantinople-3.1.2.tgz
      • babel-types-6.26.0.tgz
        • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Vulnerability Details

a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype

Publish Date: 2020-04-28

URL: WS-2020-0070

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2020-28500 (Medium) detected in lodash-4.17.15.tgz

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: connect-api-examples/connect-examples/v2/node_payment/package.json

Path to vulnerable library: connect-api-examples/connect-examples/v2/node_payment/node_modules/lodash/package.json,connect-api-examples/connect-examples/v2/node_payment/node_modules/lodash/package.json

Dependency Hierarchy:

• pug-2.0.4.tgz (Root Library)
  • pug-code-gen-2.0.2.tgz
    • constantinople-3.1.2.tgz
      • babel-types-6.26.0.tgz
        • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: lodash-4.17.21

CVE-2021-23337 (High) detected in lodash-4.17.15.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: connect-api-examples/connect-examples/v2/node_payment/package.json

Path to vulnerable library: connect-api-examples/connect-examples/v2/node_payment/node_modules/lodash/package.json,connect-api-examples/connect-examples/v2/node_payment/node_modules/lodash/package.json

Dependency Hierarchy:

• pug-2.0.4.tgz (Root Library)
  • pug-code-gen-2.0.2.tgz
    • constantinople-3.1.2.tgz
      • babel-types-6.26.0.tgz
        • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21

CVE-2021-22880 (High) detected in activerecord-5.2.4.2.gem, rails-5.2.4.2.gem

CVE-2021-22880 - High Severity Vulnerability

Vulnerable Libraries - activerecord-5.2.4.2.gem, rails-5.2.4.2.gem

activerecord-5.2.4.2.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/activerecord-5.2.4.2.gem

Dependency Hierarchy:

• rails-5.2.4.2.gem (Root Library)
  • ❌ activerecord-5.2.4.2.gem (Vulnerable Library)

rails-5.2.4.2.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: ms/2.5.0/cache/rails-5.2.4.2.gem

Dependency Hierarchy:

• ❌ rails-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

Publish Date: 2021-02-11

URL: CVE-2021-22880

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129

Release Date: 2021-02-11

Fix Resolution: 5.2.4.5,6.0.3.5,6.1.2.1

CVE-2020-8184 (High) detected in rack-2.0.6.gem

CVE-2020-8184 - High Severity Vulnerability

Vulnerable Library - rack-2.0.6.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see https://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-2.0.6.gem

Path to dependency file: connect-api-examples/connect-examples/oauth/ruby/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/rack-2.0.6.gem

Dependency Hierarchy:

• sinatra-2.0.5.gem (Root Library)
  • ❌ rack-2.0.6.gem (Vulnerable Library)

Vulnerability Details

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Publish Date: 2020-06-19

URL: CVE-2020-8184

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://groups.google.com/forum/#!topic/rubyonrails-security/OWtmozPH9Ak

Release Date: 2020-06-17

Fix Resolution: rack - 2.1.4, 2.2.3

CVE-2020-8164 (High) detected in actionpack-5.2.4.2.gem

CVE-2020-8164 - High Severity Vulnerability

Vulnerable Library - actionpack-5.2.4.2.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/actionpack-5.2.4.2.gem

Dependency Hierarchy:

• coffee-rails-4.2.2.gem (Root Library)
  • railties-5.2.4.2.gem
    • ❌ actionpack-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.

Publish Date: 2020-06-19

URL: CVE-2020-8164

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8727-m6gj-mc37

Release Date: 2020-05-31

Fix Resolution: 5.2.4.3,6.0.3.1

CVE-2021-21353 (High) detected in pug-code-gen-2.0.2.tgz

CVE-2021-21353 - High Severity Vulnerability

Vulnerable Library - pug-code-gen-2.0.2.tgz

Default code-generator for pug. It generates HTML via a JavaScript template function.

Library home page: https://registry.npmjs.org/pug-code-gen/-/pug-code-gen-2.0.2.tgz

Path to dependency file: connect-api-examples/connect-examples/v2/node_payment/package.json

Path to vulnerable library: connect-api-examples/connect-examples/v2/node_payment/node_modules/pug-code-gen/package.json,connect-api-examples/connect-examples/v2/node_payment/node_modules/pug-code-gen/package.json

Dependency Hierarchy:

• pug-2.0.4.tgz (Root Library)
  • ❌ pug-code-gen-2.0.2.tgz (Vulnerable Library)

Vulnerability Details

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the pretty option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

Publish Date: 2021-03-03

URL: CVE-2021-21353

CVSS 3 Score Details (9.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p493-635q-r6gr

Release Date: 2020-12-23

Fix Resolution: pug -3.0.1, pug-code-gen-2.0.3, pug-code-gen-3.0.2

CVE-2020-11023 (Medium) detected in jquery-3.3.1.jar, jquery-3.2.1.min.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.3.1.jar, jquery-3.2.1.min.js

jquery-3.3.1.jar

WebJar for jQuery

Library home page: http://webjars.org

Path to dependency file: connect-api-examples/connect-examples/v2/java_payment/pom.xml

Path to vulnerable library: 20200424204917/downloadResource_b99833fe-607e-4da8-9acd-f91fd57e4dd3/20200424211132/jquery-3.3.1.jar

Dependency Hierarchy:

• ❌ jquery-3.3.1.jar (Vulnerable Library)

jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: connect-api-examples/connect-examples/v2/node_orders-payments/node_modules/superagent/docs/tail.html

Path to vulnerable library: connect-api-examples/connect-examples/v2/node_orders-payments/node_modules/superagent/docs/tail.html,connect-api-examples/connect-examples/v2/node_payment/node_modules/superagent/docs/tail.html

Dependency Hierarchy:

• ❌ jquery-3.2.1.min.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0

CVE-2020-8165 (High) detected in activesupport-5.2.4.2.gem

CVE-2020-8165 - High Severity Vulnerability

Vulnerable Library - activesupport-5.2.4.2.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/activesupport-5.2.4.2.gem

Dependency Hierarchy:

• coffee-rails-4.2.2.gem (Root Library)
  • railties-5.2.4.2.gem
    • ❌ activesupport-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Publish Date: 2020-06-19

URL: CVE-2020-8165

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2p68-f74v-9wc6

Release Date: 2020-05-31

Fix Resolution: 5.2.4.3,6.0.3.1

CVE-2020-8162 (High) detected in activestorage-5.2.4.2.gem

CVE-2020-8162 - High Severity Vulnerability

Vulnerable Library - activestorage-5.2.4.2.gem

Attach cloud and local files in Rails applications.

Library home page: https://rubygems.org/gems/activestorage-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/activestorage-5.2.4.2.gem

Dependency Hierarchy:

• rails-5.2.4.2.gem (Root Library)
  • ❌ activestorage-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

Publish Date: 2020-06-19

URL: CVE-2020-8162

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m42x-37p3-fv5w

Release Date: 2020-05-31

Fix Resolution: 5.2.4.3,6.0.3.1

CVE-2019-11358 (Medium) detected in jquery-3.3.1.jar, jquery-3.2.1.min.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.3.1.jar, jquery-3.2.1.min.js

jquery-3.3.1.jar

WebJar for jQuery

Library home page: http://webjars.org

Path to dependency file: connect-api-examples/connect-examples/v2/java_payment/pom.xml

Path to vulnerable library: 20200424204917/downloadResource_b99833fe-607e-4da8-9acd-f91fd57e4dd3/20200424211132/jquery-3.3.1.jar

Dependency Hierarchy:

• ❌ jquery-3.3.1.jar (Vulnerable Library)

jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: connect-api-examples/connect-examples/v2/node_orders-payments/node_modules/superagent/docs/tail.html

Path to vulnerable library: connect-api-examples/connect-examples/v2/node_orders-payments/node_modules/superagent/docs/tail.html,connect-api-examples/connect-examples/v2/node_payment/node_modules/superagent/docs/tail.html

Dependency Hierarchy:

• ❌ jquery-3.2.1.min.js (Vulnerable Library)

Found in HEAD commit: d50fc21f5f1bd74085f9a31371ea7d49fdb5aee9

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0

CVE-2019-16782 (Medium) detected in rack-2.0.6.gem

CVE-2019-16782 - Medium Severity Vulnerability

Vulnerable Library - rack-2.0.6.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see https://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-2.0.6.gem

Path to dependency file: connect-api-examples/connect-examples/oauth/ruby/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/rack-2.0.6.gem

Dependency Hierarchy:

• sinatra-2.0.5.gem (Root Library)
  • ❌ rack-2.0.6.gem (Vulnerable Library)

Found in HEAD commit: d50fc21f5f1bd74085f9a31371ea7d49fdb5aee9

Vulnerability Details

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Publish Date: 2019-12-18

URL: CVE-2019-16782

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16782

Release Date: 2019-12-18

Fix Resolution: 1.6.12;2.0.8

CVE-2021-22885 (Medium) detected in actionpack-5.2.4.2.gem

CVE-2021-22885 - Medium Severity Vulnerability

Vulnerable Library - actionpack-5.2.4.2.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/actionpack-5.2.4.2.gem

Dependency Hierarchy:

• coffee-rails-4.2.2.gem (Root Library)
  • railties-5.2.4.2.gem
    • ❌ actionpack-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

There is a possible information disclosure vulnerability in actionpack 2.0.0 before 5.2.4.6, 5.2.6, 6.0.3.7 and 6.1.3.2 when using the redirect_to or polymorphic_url helper with untrusted user input.

Publish Date: 2021-01-07

URL: CVE-2021-22885

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjg4-8q5f-x6fm

Release Date: 2021-01-07

Fix Resolution: actionpack - 5.2.4.6,5.2.6,6.0.3.7,6.1.3.2

CVE-2020-8166 (Medium) detected in actionpack-5.2.4.2.gem

CVE-2020-8166 - Medium Severity Vulnerability

Vulnerable Library - actionpack-5.2.4.2.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-5.2.4.2.gem

Path to dependency file: connect-api-examples/connect-examples/v2/rails_payment/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/actionpack-5.2.4.2.gem

Dependency Hierarchy:

• coffee-rails-4.2.2.gem (Root Library)
  • railties-5.2.4.2.gem
    • ❌ actionpack-5.2.4.2.gem (Vulnerable Library)

Vulnerability Details

A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.

Publish Date: 2020-07-02

URL: CVE-2020-8166

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jp5v-5gx4-jmj9

Release Date: 2020-05-31

Fix Resolution: 5.2.4.3,6.0.3.1