{"id":"CVE-2017-16792","published":"2017-11-13T09:00:00Z","modified":"2024-08-05T20:35:21Z","title":"Stored cross-site scripting (XSS) vulnerability in \"geminabox\" (Gem in a Box) before 0.13.10 allows attackers to…","vendor":null,"product":null,"tier":"tail","description":{"text":"Stored cross-site scripting (XSS) vulnerability in \"geminabox\" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the \"homepage\" value of a \".gemspec\" file, related to views/gem.erb and views/index.erb.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01084,"percentile":0.65233,"provenance":"source"},"cwes":[],"references":[{"url":"https://rubygems.org/gems/geminabox/versions/0.13.10","tags":["x_refsource_MISC"]},{"url":"https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.0,"factors":[{"name":"EPSS percentile","points":13.05}]},"affected":[{"ecosystem":"RubyGems","package":"geminabox","vulnerableRanges":["<0.13.10"],"patched":["0.13.10"],"from":["GHSA-653m-r33x-39ff"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0344","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-14506","published":"2017-09-25","fixed":"0.13.6","kev":false},{"cve":"CVE-2017-14683","published":"2017-09-25","fixed":"0.13.7","kev":false,"link":{"from":"CVE-2017-14683","to":"CVE-2017-16792","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:geminabox","fromFixed":"0.13.7","toFixed":"0.13.10","daysApart":49},{"kind":"similar","provenance":"machine","score":0.51,"basis":"same package + description similarity"}]}},{"cve":"CVE-2017-16792","published":"2017-11-13","fixed":"0.13.10","kev":false}],"package":"RubyGems:geminabox"}}