CVE-2013-0256

描述

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

如何修補 CVE-2013-0256

要修補 CVE-2013-0256,請將受影響套件升級到下列已修補版本。

• RubyGems/rdoc—升級至 3.12.1 或更新版本

CVE-2013-0256 正在被利用嗎?

低 — EPSS 為 3.6%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 2.3.0, < 3.12.1

參考連結(14)

• ADVISORYgithub.com/advisories/GHSA-v2r9-c84j-v7xm
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-0256
• PATCHgithub.com/rdoc/rdoc
• WEBlists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html
• WEB