An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"last_affected": "2.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.0:beta2:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-beta2"
},
{
"last_affected": "2.0.0-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.0:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-rc1"
},
{
"last_affected": "2.0.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.0:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-rc2"
},
{
"last_affected": "2.0.0-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.0:rc3:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-rc3"
},
{
"last_affected": "2.0.0-rc3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.0:rc4:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-rc4"
},
{
"last_affected": "2.0.0-rc4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.0:rc5:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-rc5"
},
{
"last_affected": "2.0.0-rc5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.0:rc6:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-rc6"
},
{
"last_affected": "2.0.0-rc6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:sinatrarb:sinatra:2.0.1:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.1-rc1"
},
{
"last_affected": "2.0.1-rc1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "6ad721abcfe36334108dcdd05d046c361e1b7a9c"
}
],
"source": "REFERENCES_COMMIT"
}
]
}