Read the docs
TI-2018-08315 Aliases CVE-2018-11627GHSA-mq35-wqvf-r23c

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

Why it matters now

EPSS 0.02159 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed sinatra (RubyGems): 2.0.2Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—sinatra (RubyGems)2.0.0 to before 2.0.22.0.2Patch availableGHSA-mq35-wqvf-r23c
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • sinatra (RubyGems) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-mq35-wqvf-r23c

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:sinatrarb:sinatra:*:*:*:*:*:*:*:*before 2.0.2VulnerableSinatrarb
cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*4.6VulnerableRed Hat
cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*4.7VulnerableRed Hat
  • cpe:2.3:a:sinatrarb:sinatra:*:*:*:*:*:*:*:* Versions before 2.0.2 Vulnerable ·Sinatrarb
  • cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-mq35-wqvf-r23c sinatra (RubyGems) Fixed in 2.0.2 Advisory →

Red Hat 2 advisories

  • RHSA-2019:0315 Released 2019-02-12 · Red Hat rating Moderate
    CloudForms 4.6.8 security, bug fix and enhancement update
    • CloudForms Management Engine 5.9 cfme-5.9.8.1-1.el7cf, cfme-amazon-smartstate-5.9.8.1-1.el7cf, cfme-appliance-5.9.8.1-1.el7cf +4
  • RHSA-2019:0212 Released 2019-02-07 · Red Hat rating Moderate
    CloudForms 4.7 security, bug fix and enhancement update
    • CloudForms Management Engine 5.10 ansible-runner-1.1.2-2.el7ar, ansible-tower-3.3.3-1.el7at, ansible-tower-server-3.3.3-1.el7at +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5.10Fixed RHSA-2019:0212
CloudForms Management Engine 5.9Fixed RHSA-2019:0315
Not affected: 14 products
  • Red Hat Ceph Storage 1.3
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools
  • Red Hat Enterprise MRG 2
  • Red Hat OpenStack Platform 10 (Newton) Operational Tools
  • Red Hat OpenStack Platform 12 (Pike) Operational Tools
  • Red Hat OpenStack Platform 8 (Liberty) Operational Tools
  • Red Hat OpenStack Platform 9 (Mitaka) Operational Tools
  • Red Hat Satellite 6
  • Red Hat Software Collections
  • Red Hat Storage 3
  • Red Hat Subscription Asset Manager

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11627
  2. 2026-10-03 Alias added: GHSA-mq35-wqvf-r23c

References

Exploit 1

Patch 1

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences