Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXIyM2ctM3F3NC1nZmgy

RedCloth Cross-site Scripting vulnerability

Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.

Permalink: https://github.com/advisories/GHSA-r23g-3qw4-gfh2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXIyM2ctM3F3NC1nZmgy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 6 years ago
Updated: 6 months ago

Identifiers: GHSA-r23g-3qw4-gfh2, CVE-2012-6684
References:

• https://nvd.nist.gov/vuln/detail/CVE-2012-6684
• https://gist.github.com/co3k/75b3cb416c342aa1414c
• http://seclists.org/fulldisclosure/2014/Dec/50
• http://www.debian.org/security/2015/dsa-3168
• https://co3k.org/blog/redcloth-unfixed-xss-en
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2012-6684.yml
• https://web.archive.org/web/20150128115714/http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss
• https://github.com/advisories/GHSA-r23g-3qw4-gfh2

Blast Radius: 1.0

Affected Packages