Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote
    attackers to inject arbitrary web script or HTML via a javascript: URI. (CVE-2012-6684)

rubygem-RedCloth was updated to fix one security issue.

The following vulnerability was fixed :

CVE-2012-6684: A cross-site scripting (XSS) vulnerability allowed remote attackers to inject arbitrary web script or HTML via a javascript: URI (boo#912212)

Kousuke Ebihara discovered that redcloth, a Ruby module used to convert Textile markup to HTML, did not properly sanitize its input.
This allowed a remote attacker to perform a cross-site scripting attack by injecting arbitrary JavaScript code into the generated HTML.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kousuke Ebihara discovered that redcloth, a Ruby module used to convert Textile markup to HTML, did not properly sanitize its input.
This allowed a remote attacker to perform a cross-site scripting attack by injecting arbitrary JavaScript code into the generated HTML.

ID	Name	Product	Family	Severity
421862	SCA: security update for redcloth (GHSA-r23g-3qw4-gfh2)	Tenable Cloud Security	SCA Checks	medium
421862	SCA: security update for redcloth (GHSA-r23g-3qw4-gfh2)	Tenable Self-Hosted Container Security	SCA Checks	medium
84532	openSUSE Security Update : rubygem-RedCloth (openSUSE-2015-457)	Nessus	SuSE Local Security Checks	medium
82151	Debian DLA-167-1 : redcloth security update	Nessus	Debian Local Security Checks	medium
81447	Debian DSA-3168-1 : ruby-redcloth - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-6684

medium

Tenable Plugins

medium

medium

medium

medium

medium