Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/48004?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48004?format=api", "vulnerability_id": "VCID-3jru-u17n-tyg1", "summary": "Rack has a Possible Information Disclosure Vulnerability\nA possible information disclosure vulnerability existed in `Rack::Sendfile` when running behind a proxy that supports `x-sendfile` headers (such as Nginx). Specially crafted headers could cause `Rack::Sendfile` to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions.", "aliases": [ { "alias": "CVE-2025-61780" }, { "alias": "GHSA-r657-rxjc-j557" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/70810?format=api", "purl": "pkg:gem/rack@2.2.20", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/70811?format=api", "purl": "pkg:gem/rack@3.1.18", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.18" }, { "url": "http://public2.vulnerablecode.io/api/packages/70812?format=api", "purl": "pkg:gem/rack@3.2.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.3" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/70809?format=api", "purl": "pkg:gem/rack@3.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3jru-u17n-tyg1" }, { "vulnerability": "VCID-e11g-k7zm-vkhu" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/70748?format=api", "purl": "pkg:gem/rack@3.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3jru-u17n-tyg1" }, { "vulnerability": "VCID-dss4-6ptr-83av" }, { "vulnerability": "VCID-e11g-k7zm-vkhu" }, { "vulnerability": "VCID-k8fr-zuyx-yyhg" }, { "vulnerability": "VCID-xpa3-1n87-8ucv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2" } ], "references": [ { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/commit/57277b7741581fa827472c5c666f6e6a33abd784", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/rack/rack/commit/57277b7741581fa827472c5c666f6e6a33abd784" }, { "reference_url": "https://github.com/rack/rack/commit/7e69f65eefe9cd2868df9f9f3b0977b86f93523a", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/rack/rack/commit/7e69f65eefe9cd2868df9f9f3b0977b86f93523a" }, { "reference_url": "https://github.com/rack/rack/commit/fba2c8bc63eb787ff4b19bc612d315fda6126d85", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/rack/rack/commit/fba2c8bc63eb787ff4b19bc612d315fda6126d85" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61780", "reference_id": "CVE-2025-61780", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61780" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-61780.yml", "reference_id": "CVE-2025-61780.YML", "reference_type": "", "scores": [], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-61780.yml" }, { "reference_url": "https://github.com/advisories/GHSA-r657-rxjc-j557", "reference_id": "GHSA-r657-rxjc-j557", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-r657-rxjc-j557" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-r657-rxjc-j557", "reference_id": "GHSA-r657-rxjc-j557", "reference_type": "", "scores": [], "url": "https://github.com/rack/rack/security/advisories/GHSA-r657-rxjc-j557" } ], "weaknesses": [ { "cwe_id": 200, "name": "Exposure of Sensitive Information to an Unauthorized Actor", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information." }, { "cwe_id": 441, "name": "Unintended Proxy or Intermediary ('Confused Deputy')", "description": "The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor." }, { "cwe_id": 913, "name": "Improper Control of Dynamically-Managed Code Resources", "description": "The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3jru-u17n-tyg1" }