CVEvulnerability
CVE-2012-6684
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-01-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.
Affected configurations
• redcloth redcloth library (<= 4.2.9)
• debian debian linux 7.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://co3k.org/blog/redcloth-unfixed-xss-en Broken Link
- http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss Third Party Advisory
- http://seclists.org/fulldisclosure/2014/Dec/50 Exploit, Mailing List, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3168 Third Party Advisory
- https://gist.github.com/co3k/75b3cb416c342aa1414c Issue Tracking, Patch
- http://co3k.org/blog/redcloth-unfixed-xss-en Broken Link
- http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss Third Party Advisory
- http://seclists.org/fulldisclosure/2014/Dec/50 Exploit, Mailing List, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3168 Third Party Advisory
- https://gist.github.com/co3k/75b3cb416c342aa1414c Issue Tracking, Patch