CVE-2012-6684 RedCloth Cross-site Scripting vulnerability
MediumCVSS 4.3
EPSS 2.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems redcloth(RubyGems) | < 4.3.0 | 4.3.0 |
| rubygems redcloth(RubyGems) | = 3.0.0 | No fix listed |
| rubygems redcloth(RubyGems) | = 3.0.1 | No fix listed |
| rubygems redcloth(RubyGems) | = 3.0.2 | No fix listed |
| rubygems redcloth(RubyGems) | = 3.0.3 | No fix listed |
| rubygems redcloth(RubyGems) | = 3.0.4 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.0.0 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.0.1 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.0.2 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.0.3 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.0.4 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.1.0 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.1.1 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.1.9 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.0 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.1 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.2 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.3 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.4 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.4.pre1 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.4.pre2 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.4.pre3 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.5 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.7 | No fix listed |
| rubygems redcloth(RubyGems) | = 4.2.8 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems redcloth(RubyGems) | = 4.2.9 | No fix listed |
| debian/ruby-redcloth(Debian:12) | < 4.2.9-4 | 4.2.9-4 |
| debian/ruby-redcloth(Debian:13) | < 4.2.9-4 | 4.2.9-4 |
| debian/ruby-redcloth(Debian:14) | < 4.2.9-4 | 4.2.9-4 |
| redcloth library | <= 4.2.9 | No fix listed |
| debian linux | = 7.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- gist.github.com issue-tracking patch
- 20141211 RedCloth contains unfixed XSS vulnerability for 9 years exploit mailing-list third-party-advisory
- DSA-3168 third-party-advisory vendor-advisory
- co3k.org
- github.com exploit
- web.archive.org
- github.com
- Debian Security Tracker CVE-2012-6684 vendor-advisory
- co3k.org broken-link
- jgarber.lighthouseapp.com third-party-advisory
- bugs.debian.org issue-tracking