Contents

---
gem: rdoc
cve: 2013-0256
osvdb: 90004
url: https://nvd.nist.gov/vuln/detail/CVE-2013-0256
title: RDoc 2.3.0 through 3.12 XSS Exploit
date: 2013-02-06

description: |
  Doc documentation generated by rdoc 2.3.0 through rdoc 3.12 and prereleases
  up to rdoc 4.0.0.preview2.1 are vulnerable to an XSS exploit. This exploit
  may lead to cookie disclosure to third parties.
  
  The exploit exists in darkfish.js which is copied from the RDoc install
  location to the generated documentation.
  
  RDoc is a static documentation generation tool. Patching the library itself
  is insufficient to correct this exploit.
  
  This exploit was discovered by Evgeny Ermakov <[e-mail]>.

cvss_v2: 4.3

patched_versions:
  - ~> 3.9.5
  - ~> 3.12.1
  - ">= 4.0"

Version data entries

1 entries across 1 versions & 1 rubygems

Version	Path
bundler-audit-0.7.0.1	data/ruby-advisory-db/gems/rdoc/CVE-2013-0256.yml