Detections
Analytics
FreeBSD : rubygem-redcarpet -- XSS vulnerability (c368155a-fa83-11e4-bc58-001e67150279)
high Nessus Plugin ID 83514
Language:
Synopsis
The remote FreeBSD host is missing a security-related update.Description
Daniel LeCheminant reports :When markdown is being presented as HTML, there seems to be a strange interaction between _ and @ that lets an attacker insert malicious tags.
Solution
Update the affected package.See Also
http://danlec.com/blog/bug-in-sundown-and-redcarpet
https://hackerone.com/reports/46916
Plugin Details
Severity: High
ID: 83514
File Name: freebsd_pkg_c368155afa8311e4bc58001e67150279.nasl
Version: 2.5
Type: Local
Family: FreeBSD Local Security Checks
Published: 5/18/2015
Updated: 1/6/2021
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:rubygem-redcarpet
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 5/14/2015
Vulnerability Publication Date: 4/7/2015