CVE-2019-10770

Name of the Vulnerable Software and Affected Versions io.ratpack:ratpack-core versions 0.9.10 through 1.7.5

Description The issue affects the development mode error handler when an exception message contains untrusted data, allowing for Cross-site Scripting (XSS). This can be exploited when users do not disable development mode in production. The production mode error handler is not vulnerable.

Recommendations For versions 0.9.10 through 1.7.5, update to version 1.7.6 to resolve the issue. As a temporary workaround, ensure that development mode is disabled in production. Avoid using real customer data (i.e., untrusted user input) in development.