CVE-2013-0256 / OSVDB-90004
rdoc Moderate
Cross-Site Scripting
Discovered 9 months ago
Published over 8 years ago
Category: Cross-Site Scripting
Source: NIST NVD
Severity: Moderate

Doc documentation generated by rdoc 2.3.0 through rdoc 3.12 and prereleases up to rdoc 4.0.0.preview2.1 are vulnerable to an XSS exploit. This exploit may lead to cookie disclosure to third parties.

The exploit exists in darkfish.js which is copied from the RDoc install location to the generated documentation.

RDoc is a static documentation generation tool. Patching the library itself is insufficient to correct this exploit.

This exploit was discovered by Evgeny Ermakov corwmh@gmail.com.

CVSS Metrics
Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
Network Network None None Partial None
Patched Versions

~> 3.9.5 ~> 3.12.1 >= 4.0

Unaffected Versions

n/a

References

n/a