Gem in a Box vulnerable to Cross-site Request Forgery

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2017-14683 · ADVISORY
• geminabox/geminabox commit a01c4e8 · WEB
• geminabox/geminabox · PACKAGE
• geminabox/geminabox · WEB
• rubysec/ruby-advisory-db · WEB
• baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html · WEB

geminabox のその他の脆弱性

• CVE-2017-16792中 6.1Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script…
• CVE-2017-14506中 5.4geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .ge…