CVE-2013-0256: XSS
A cross-site scripting (XSS) flaw was found in the way Darkfish Rdoc HTML generator / template of RDoc, HTML and command-line documentation producing tool for Ruby, performed sanitization of certain values when creating Rdoc documentation. When Ruby on Rails application exposed its documentation via network, a remote attacker could provide a specially-crafted URL that, when opened would lead to arbitrary web script or HTML code execution in the context of (particular Ruby on Rails application) user's session.
This issue affects RDoc versions 2.3.0 to 3.12.
Other sources
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0256?
CVE-2013-0256 has been assigned a medium severity level due to potential cross-site scripting vulnerabilities.
How do I fix CVE-2013-0256?
To fix CVE-2013-0256, update RDoc to version 3.9.6 or higher, or any version above 4.0.0.
What software is affected by CVE-2013-0256?
CVE-2013-0256 affects RDoc versions up to 3.9.5, 3.12.1, and 4.0.0-preview2, as well as several Ruby versions.
How does CVE-2013-0256 exploit work?
CVE-2013-0256 exploits a cross-site scripting flaw in the sanitization process during RDoc documentation generation.
Can CVE-2013-0256 affect my Ruby on Rails application?
Yes, if your Ruby on Rails application exposes its RDoc documentation without proper sanitization, it can be vulnerable to CVE-2013-0256.