Vulnerability Description
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Yardoc | Yard | < 0.9.36 |
| Fedoraproject | Fedora | 38 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aaPatch
- https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054bePatch
- https://github.com/lsegal/yard/pull/1538Issue TrackingPatch
- https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrcExploitVendor Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/03/msg00006.htmlMailing List
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing List
- https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aaPatch
- https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054bePatch
- https://github.com/lsegal/yard/pull/1538Issue TrackingPatch
- https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrcExploitVendor Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/03/msg00006.htmlMailing List
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing List
FAQ
What is CVE-2024-27285?
CVE-2024-27285 is a vulnerability with a CVSS score of 5.4 (MEDIUM). YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input...
How severe is CVE-2024-27285?
CVE-2024-27285 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-27285?
Check the references section above for vendor advisories and patch information. Affected products include: Yardoc Yard, Fedoraproject Fedora, Debian Debian Linux.