CVE-2024-21510
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
- Record
CVE-2024-21510- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P - Weakness
- CWE-807
- Updated
- 2026-11-02
EUVDEUVD-2024-3268
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
- Record
EUVD-2024-3268- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hxx2-7vcw-mqr3
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
- Record
GHSA-hxx2-7vcw-mqr3- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-807
- Updated
- 2026-11-02
NVD
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
- Record
CVE-2024-21510- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-807
- Updated
- 2026-11-02
OSV
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
- Record
CVE-2024-21510- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-21510
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
- Record
DEBIAN-CVE-2024-21510- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-hxx2-7vcw-mqr3
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
- Record
GHSA-hxx2-7vcw-mqr3- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-807
- Updated
- 2026-11-02
OSVRHSA-2024:10987
Red Hat Security Advisory: pcs security update
- Record
RHSA-2024:10987- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-21510
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
- Record
UBUNTU-CVE-2024-21510- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVALSA-2024:10987 No score
Moderate: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.
Security Fix(es):
- sinatra: Open Redirect Vulnerability in Sinatra via X-Forwarded-Host Header (CVE-2024-21510)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2024:10987- Updated
- 2026-11-02
OSVRLSA-2024:10987 No score
Moderate: pcs security update
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.
Security Fix(es):
- sinatra: Open Redirect Vulnerability in Sinatra via X-Forwarded-Host Header (CVE-2024-21510)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2024:10987- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sinatraRubyGems |
before 4.1.0 | 4.1.0 |
pcsAlmaLinux:8 |
before 0.10.18-2.el8_10.3.alma.1 | 0.10.18-2.el8_10.3.alma.1 |
pcs-snmpAlmaLinux:8 |
before 0.10.18-2.el8_10.3.alma.1 | 0.10.18-2.el8_10.3.alma.1 |
ruby-sinatraDebian:12 |
All versions, plus listed versions 3.0.5-33.0.5-3+deb12u13.2.0-14.1.1-14.1.1-2 Show 9 moreShow less4.1.1-34.1.1-44.1.1-54.1.1-64.2.1-14.2.1-24.2.1-34.2.1-44.2.1-5 |
None known |
ruby-sinatraDebian:13 |
before 4.1.1-2 | 4.1.1-2 |
ruby-sinatraDebian:14 |
before 4.1.1-2 | 4.1.1-2 |
sinatraRubyGems |
before 4.1.0, plus listed versions 0.1.00.1.50.1.60.1.70.2.0 Show 45 moreShow less0.2.10.2.20.3.00.3.10.3.20.3.30.9.00.9.0.10.9.0.20.9.0.30.9.0.40.9.0.50.9.10.9.1.10.9.20.9.40.9.50.9.61.01.0.a1.0.b1.1.01.1.21.1.31.1.41.1.a1.1.b1.2.01.2.0.a1.2.0.c1.2.0.d1.2.11.2.21.2.31.2.61.2.71.2.81.2.91.3.01.3.0.a1.3.0.b1.3.0.c1.3.0.d1.3.0.e1.3.0.f |
4.1.0 |
pcsRed Hat:enterprise_linux:8::highavailability |
before 0:0.10.18-2.el8_10.3 | 0:0.10.18-2.el8_10.3 |
pcs-snmpRed Hat:enterprise_linux:8::highavailability |
before 0:0.10.18-2.el8_10.3 | 0:0.10.18-2.el8_10.3 |
pcsRed Hat:enterprise_linux:8::resilientstorage |
before 0:0.10.18-2.el8_10.3 | 0:0.10.18-2.el8_10.3 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pcs-snmpRed Hat:enterprise_linux:8::resilientstorage |
before 0:0.10.18-2.el8_10.3 | 0:0.10.18-2.el8_10.3 |
pcsRocky Linux:8 |
before 0:0.10.18-2.el8_10.3 | 0:0.10.18-2.el8_10.3 |
ruby-sinatraUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.4.6-21.4.7-31.4.7-3ubuntu0.1~esm21.4.7-3ubuntu0.1~esm3 |
None known |
ruby-sinatraUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4.7-51.4.8-11.4.8-1ubuntu0.1~esm21.4.8-1ubuntu0.1~esm3 |
None known |
ruby-sinatraUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.5-4ubuntu12.0.8.1-12.0.8.1-1ubuntu0.1~esm22.0.8.1-1ubuntu0.1~esm3 |
None known |
ruby-sinatraUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.8.1-22.0.8.1-2+deb11u1build0.22.04.1 |
None known |
ruby-sinatraUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.5-33.0.5-3ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21510 is a medium vulnerability (CVSS 5.4) in Sinatra, published November 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in sinatra 4.1.0.
References
security.snyk.io/vuln/SNYK-RUBY-SINATRA-6483832
github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb%23L319
nvd.nist.gov/vuln/detail/CVE-2024-21510
Show 17 moreShow less
access.redhat.com/errata/RHSA-2024:10987
bugzilla.redhat.com/2323117
errata.almalinux.org/8/ALSA-2024-10987.html
security-tracker.debian.org/tracker/CVE-2024-21510
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10987.json
cve.org/CVERecord?id=CVE-2024-21510
errata.rockylinux.org/RLSA-2024:10987
ubuntu.com/security/CVE-2024-21510
Left out here: 54 versions. The JSON record has them.