[RUBYSEC:RUBYGEMS-UPDATE-2018-1000078] RubyGems Cross-site Scripting vulnerability
Severity
Medium
Affected Packages
1
Fixed Packages
1
CVEs
1
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and
earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability
in gem server display of homepage attribute that can result in XSS. This attack
requires the victim to browse to a malicious gem on a vulnerable gem server. This
vulnerability is fixed in 2.7.6.
| Package | Affected Version |
|---|---|
 pkg:gem/rubygems-update
|
< 2.7.6 |
| Package | Fixed Version |
|---|---|
|
pkg:gem/rubygems-update
|
>= 2.7.6 |
- ID
- RUBYSEC:RUBYGEMS-UPDATE-2018-1000078
- Severity
- medium
- URL
- https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb
- Published
-
2022-05-14T00:00:00
(2 years ago) - Modified
-
2023-05-03T23:49:55
(16 months ago) - Rights
- RubySec Security Team
- Other Advisories
ALAS-2018-983
DSA-4219-1
ELSA-2019-2028
FEDORA-2018-1fffa787e7
MAVEN:GHSA-87QX-G5WG-MWMJ
openSUSE-SU-2019:1771-1
RHSA-2019:2028
SUSE-SU-2019:1804-1
USN-3621-1| Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
|---|---|---|---|---|---|---|---|
| Fixed | pkg:gem/rubygems-update |
rubygems-update
|
>= 2.7.6 | ||||
| Affected | pkg:gem/rubygems-update |
rubygems-update
|
< 2.7.6 |
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
|---|---|---|---|---|---|---|---|---|---|---|---|
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |