CVE-2018-1000078
Public on 2018-03-13
Modified on 2019-08-27
Description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.
Severity
Medium
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | ruby | 2018-04-05 | ALAS2-2018-983 | Fixed |
| Amazon Linux 2 - Core | ruby | 2019-08-23 | ALAS2-2019-1276 | Fixed |
| Amazon Linux 1 | ruby20 | 2018-04-04 | ALAS-2018-983 | Fixed |
| Amazon Linux 1 | ruby22 | 2018-04-04 | ALAS-2018-983 | Fixed |
| Amazon Linux 1 | ruby23 | 2018-04-04 | ALAS-2018-983 | Fixed |
| Amazon Linux 1 | ruby24 | 2018-04-04 | ALAS-2018-983 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | CVSSv2 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| NVD | CVSSv3 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |