CVE-2017-14683: Gem in a Box vulnerable to Cross-site… – CVSS 8.8 · Watchpost

← All vulnerabilities

Gem in a Box vulnerable to Cross-site Request Forgery

高危 8.8CVE-2017-14683 · GHSA-qwv2-2x8g-g43g · Published 25/09/2017 · updated 17/06/2026

要点

CVE-2017-14683 是影响 geminabox, geminabox (geminabox project) 的高危 (CVSS 8.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.50%，高于 42.7% 的漏洞。
修复：升级到 0.13.7 或更高版本。

Package	Affected versions	Patched versions
geminabox RubyGems	`< 0.13.7`	`0.13.7`
geminabox geminabox_project	`≤ 0.13.6`	No fix yet

Description

geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.

NVD description

geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.

References

nvd.nist.gov/vuln/detail/CVE-2017-14683 · ADVISORY
geminabox/geminabox commit a01c4e8 · WEB
geminabox/geminabox · PACKAGE
geminabox/geminabox · WEB
rubysec/ruby-advisory-db · WEB
baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html · WEB

geminabox 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free