GitHub Advisoryadvisory · RubyGems

GHSA-c289-47qf-rvrr Cross Site Scripting (XSS) vulnerability in easymon

MEDIUM Published 2018-12-21 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-1000855
Ecosystem
RubyGems
Packages
easymon
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems easymon: < 1.4.1 → fixed in 1.4.1

Description

easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.

Related

Alias · CVE (1)

  • CVE-2018-1000855 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References