ADVISORIES

• CVE-2017-16792 (NVD)
• GHSA-653m-r33x-39ff
• Vendor Advisory

GEM

geminabox

SEVERITY

CVSS v3.x: 6.1 (Medium)

PATCHED VERSIONS

• >= 0.13.10

DESCRIPTION

Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) allows attackers to inject arbitrary web script via a crafted JavaScript URL in the "homepage" value of a ".gemspec" file.

A ".gemspec" file must be created with a JavaScript URL in the homepage value. This can be used to build a gem for upload to the Geminabox server, in order to achieve stored XSS via the gem hyperlink.

RELATED

• https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7
• https://github.com/geminabox/geminabox/commit/e7e0b16147677e9029f0b55eff6bc6dda52398d4