GitHub Advisoryadvisory · RubyGems
GHSA-9hx9-w2j6-rw76 Script Injection in Show In Browser gem
MEDIUM
Official page ↗
- Aliases
- CVE-2013-2105
- Ecosystem
- RubyGems
- Packages
- show_in_browser
- Severity
- Moderate
- Weaknesses
- CWE-59
- Reviewed
- 2020-06-16
Affected packages
• RubyGems show_in_browser: 0.0.3 (no fix yet)
Description
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on `/tmp/browser.html`.
Related
Alias · CVE (1)
- CVE-2013-2105 The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on… vulnerability
Weakness · CWE (1)
- CWE-59 Improper Link Resolution Before File Access weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-2105 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/84378 web
- https://github.com/jonleung/show_in_browser package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/show_in_browser/CVE-2013-2105.yml web
- http://vapid.dhs.org/advisories/show_in_browser.html web
- http://www.openwall.com/lists/oss-security/2013/05/18/4 web