Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY1M20tcjMzeC0zOWZm
Geminabox contains Cross-site Scripting
Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.
Permalink: https://github.com/advisories/GHSA-653m-r33x-39ffJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY1M20tcjMzeC0zOWZm
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 5 years ago
Updated: 3 months ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-653m-r33x-39ff, CVE-2017-16792
References:
- https://nvd.nist.gov/vuln/detail/CVE-2017-16792
- https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7
- https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md
- https://rubygems.org/gems/geminabox/versions/0.13.10
- https://github.com/advisories/GHSA-653m-r33x-39ff
Affected Packages
rubygems:geminabox
Versions: < 0.13.10Fixed in: 0.13.10