Skip to content

CVE-2024-27285 (Medium) detected in yard-0.8.0.gem #336

Description

@mend-bolt-for-github

CVE-2024-27285 - Medium Severity Vulnerability

Vulnerable Library - yard-0.8.0.gem

YARD is a documentation generation tool for the Ruby programming language. It enables the user to generate consistent, usable documentation that can be exported to a number of formats very easily, and also supports extending for custom Ruby constructs such as custom class level definitions.

Library home page: https://rubygems.org/gems/yard-0.8.0.gem

Path to dependency file: /test/acceptance/workspaces/ruby-app-thresholds/Gemfile.lock

Path to vulnerable library: /test/acceptance/workspaces/ruby-app-thresholds/Gemfile.lock,/test/acceptance/workspaces/ruby-app-policy/Gemfile.lock

Dependency Hierarchy:

  • ❌ yard-0.8.0.gem (Vulnerable Library)

Found in HEAD commit: 9505f4ca92405cc9273dc3726c2d274ce28a4407

Found in base branch: ALL_HANDS/major-secrets

Vulnerability Details

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.

Publish Date: 2024-02-28

URL: CVE-2024-27285

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8mq4-9jjh-9xrc

Release Date: 2024-02-28

Fix Resolution: yard - 0.9.35


Step up your Open Source Security Game with Mend here

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions