CVE-2024-27285

Katalog CVE

CVSS 6.1 · Medium EPSS 1,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada yardoc yard, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.

Rincian

Terbit di NVD

28 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc exploit · advisory vendor
• https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa patch
• https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be patch
• https://github.com/lsegal/yard/pull/1538 issue tracking · patch
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR... mailing list