- Description
- Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
- Source
- security-advisories@github.com
- NVD status
- Modified
- Products
- rack
CVSS 4.0
- Type
- Secondary
- Base score
- 6.9
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- MEDIUM
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Severity
- HIGH
- security-advisories@github.com
- CWE-93
- Hype score
- Not currently trending
Opswat , Security analysis of Rack Ruby Framework -- CVE-2025-25184, CVE-2025-27111, and CVE-2025-27610 -- https://t.co/Kfk6bRPZWf
@AndreGironda
28 Apr 2025
259 Impressions
2 Retweets
6 Likes
0 Bookmarks
0 Replies
0 Quotes
Threat Alert: Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610) CVE-2025-27610 CVE-2025-25184 CVE-2025-27111 Severity: ⚠️ Critical Maturity: 💢 Emerging Learn more: https://t.co/fSaNyewKqd #CyberSecurity #ThreatIntel #InfoSec (1/3)
@fletch_ai
27 Apr 2025
63 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
🔴 Tres nuevas fallas de seguridad (CVE-2025-27610, CVE-2025-27111, CVE-2025-25184) en la interfaz del servidor web Rack Ruby que, si se explotan con éxito, podrían dar acceso no autorizado a archivos, inyectar malware y alterar registros bajo ciertas condiciones. 🧉 http
@MarquisioX
26 Apr 2025
27 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-27111 Log Injection Vulnerability in Rack Middleware via X-Sendfile-Type Header https://t.co/uQUEVw1uSz
@VulmonFeeds
4 Mar 2025
15 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
"vulnerable": true,
"matchCriteriaId": "1A2C9248-025B-443D-ADA4-7337333D5F0C",
"versionEndExcluding": "2.2.12"
},
{
"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
"vulnerable": true,
"matchCriteriaId": "CACC633C-A4E0-40C4-A22B-CB0FB996A845",
"versionEndExcluding": "3.0.13",
"versionStartIncluding": "3.0.0"
},
{
"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
"vulnerable": true,
"matchCriteriaId": "70BD9B20-C573-4044-ACE5-F1B95EB4A652",
"versionEndExcluding": "3.1.11",
"versionStartIncluding": "3.1.0"
}
],
"operator": "OR"
}
]
}
]