Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2013-0256

UNKNOWN
Published 2013-03-01T02:00:00
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2013-0256. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

RDoc contains XSS vulnerability

GHSA-v2r9-c84j-v7xm

Advisory Details

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

Affected Packages

RubyGems rdoc
ECOSYSTEM: ≥2.3.0 <3.12.1

CVSS Scoring

CVSS Score

5.0

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2013-0256
WEB https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60
WEB https://bugzilla.redhat.com/show_bug.cgi?id=907820
ADVISORY https://github.com/advisories/GHSA-v2r9-c84j-v7xm
PACKAGE https://github.com/rdoc/rdoc
WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2013-0256.yml
WEB https://web.archive.org/web/20130402173730/http://blog.segment7.net:80/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2
WEB http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html
WEB http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html
WEB http://rhn.redhat.com/errata/RHSA-2013-0686.html
WEB http://rhn.redhat.com/errata/RHSA-2013-0701.html
WEB http://rhn.redhat.com/errata/RHSA-2013-0728.html
WEB http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256
WEB http://www.ubuntu.com/usn/USN-1733-1

Advisory provided by GitHub Security Advisory Database. Published: October 24, 2017, Modified: July 5, 2023

References

http://rhn.redhat.com/errata/RHSA-2013-0701.html
http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/
http://secunia.com/advisories/52774
http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html
http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2
http://rhn.redhat.com/errata/RHSA-2013-0728.html
http://rhn.redhat.com/errata/RHSA-2013-0686.html
https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60
http://rhn.redhat.com/errata/RHSA-2013-0548.html
http://www.ubuntu.com/usn/USN-1733-1
https://bugzilla.redhat.com/show_bug.cgi?id=907820
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html

HackerOne Reports

XSS exploit of RDoc documentation generated by rdoc Medium
sighook
Ruby
Cross-site Scripting (XSS) - Stored
View Report
Published: 2013-03-01T02:00:00
Last Modified: 2024-08-06T14:18:09.523Z
Copied to clipboard!