CVE-2024-27285 — Cross-site Scripting in Yard

CWE-79 — Cross-site Scripting9 documents7 sources
Severity
6.1MEDIUMNVD
CNA5.4OSV7.5
EPSS
3.3%
top 12.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Lsegal YardYardoc YardDebian Linux+1 more
Timeline
PublishedFeb 28
Latest updateApr 15

Description

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

▶CVEListV5lsegal/yard< 0.9.36
▶NVDyardoc/yard< 0.9.36
▶RubyGemsyardoc/yard< 0.9.36
▶Debianyardoc/yard< 0.9.24-1+deb11u1+3
▶Ubuntuyardoc/yard< 0.9.24-1+deb11u1build0.20.04.1+3

Also affects: Debian Linux 10.0, Fedora 38

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
yard vulnerabilities↗2024-04-15
▶
OSV
YARD's default template vulnerable to Cross-site Scripting in generated frames.html↗2024-02-28
▶
CVEList
YARD's default template vulnerable to Cross-site Scripting in generated frames.html↗2024-02-28
▶
GHSA
YARD's default template vulnerable to Cross-site Scripting in generated frames.html↗2024-02-28
▶
OSV
CVE-2024-27285: YARD is a Ruby Documentation tool↗2024-02-28
▶

📋Vendor Advisories

3
Ubuntu
YARD vulnerabilities↗2024-04-15
▶
Red Hat
yard: Cross-site scripting in the frams.erb template file↗2024-02-28
▶
Debian
CVE-2024-27285: yard - YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's ...↗2024
▶
CVE-2024-27285 — Cross-site Scripting in Lsegal Yard | cvebase