{"cve":"CVE-2017-11173","nvd":{"published":"2017-07-13T03:29:00.217","modified":"2026-06-17T01:01:20.990","status":"Modified","description":"Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":[],"references":["http://seclists.org/fulldisclosure/2017/Jul/22","http://www.debian.org/security/2017/dsa-3931","https://github.com/cyu/rack-cors/commit/42ebe6caa8e85ffa9c8a171bda668ba1acc7a5e6","https://packetstormsecurity.com/files/143345/rack-cors-Missing-Anchor.html","http://seclists.org/fulldisclosure/2017/Jul/22"],"products":["debian:debian_linux","rack-cors_project:rack-cors"],"source":"nvd","synced_at":"2026-10-19T20:43:44.556243339+00:00"},"epss":{"cve":"CVE-2017-11173","score":0.02345,"percentile":0.83654,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-2j9c-9vmv-7m39","url":"https://osv.dev/vulnerability/GHSA-2j9c-9vmv-7m39","summary":"Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request","modified":"2024-12-03T06:02:08.526584Z","packages":[{"ecosystem":"RubyGems","name":"rack-cors","purl":"pkg:gem/rack-cors","ranges":["<0.4.1"],"fixed":["0.4.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}