CVE-2017-14683 Gem in a Box vulnerable to Cross-site Request Forgery
HighCVSS 8.8
EPSS 0.50%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems geminabox(RubyGems) | < 0.13.7 | 0.13.7 |
| rubygems geminabox(RubyGems) | = 0.1.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.10.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.10.1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.11.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.11.1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.12.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.12.1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.12.2 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.12.3 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.12.4 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.13.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.13.1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.13.2 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.13.3 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.13.4 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.13.5 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.13.6 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.10 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.11 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.13 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.14 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.15 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems geminabox(RubyGems) | = 0.2.2 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.3 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.4 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.5 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.6 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.7 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.8 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.9 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.2.9.pre1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.3.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.3.1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.3.2 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.3.3 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.4.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.5.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.5.1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.5.2 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.6.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.6.1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.6.1pre1 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.7.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.8.0 | No fix listed |
| rubygems geminabox(RubyGems) | = 0.9.0 | No fix listed |
| geminabox project geminabox | <= 0.13.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch release-notes third-party-advisory
- baraktawily.blogspot.co.il exploit third-party-advisory
- github.com patch
- github.com exploit
- github.com
- github.com product