jtdowney/private_address_check · Security
private_address_check contains Incomplete List of Disallowed Inputs
- GHSA ID
- GHSA-3v3c-r5v2-68ph
- CVE ID
- CVE-2017-0909
- Severity
- high
- Published
- Updated
Description
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
CWEs
- CWE-184 · Incomplete List of Disallowed Inputs