CVE-2013-0256

Description

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

How to fix CVE-2013-0256

To remediate CVE-2013-0256, upgrade the affected package to a fixed version below.

• RubyGems/rdoc—upgrade to 3.12.1 or later

Is CVE-2013-0256 being exploited?

Low — EPSS is 2.7%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 2.3.0, < 3.12.1

References (14)

• ADVISORYgithub.com/advisories/GHSA-v2r9-c84j-v7xm
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-0256
• PATCHgithub.com/rdoc/rdoc
• WEBlists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html
• WEB