CVE:CVE-2018-11627
CNNVD:CNNVD-201805-1210
Sinatra是一种基于Ruby的用于创建Web应用程序的域专用语言。
Sinatra 2.0.2之前版本中存在跨站脚本漏洞。远程攻击可借助400 Bad Request页面利用该漏洞注入任意的Web脚本或HTML。
solution:Upgrade sinatrarb sinatra to a higher version than 2.0.2,and avoid the version (,2.0.2); Upgrade redhat cloudforms to a higher version than 4.6,4.7,and avoid the version 4.6,4.7