diff --git a/advisories/github-reviewed/2017/11/GHSA-x7p2-x2j6-mwhr/GHSA-x7p2-x2j6-mwhr.json b/advisories/github-reviewed/2017/11/GHSA-x7p2-x2j6-mwhr/GHSA-x7p2-x2j6-mwhr.json index 42a39f4c294..bd543e52053 100644 --- a/advisories/github-reviewed/2017/11/GHSA-x7p2-x2j6-mwhr/GHSA-x7p2-x2j6-mwhr.json +++ b/advisories/github-reviewed/2017/11/GHSA-x7p2-x2j6-mwhr/GHSA-x7p2-x2j6-mwhr.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-x7p2-x2j6-mwhr", - "modified": "2023-01-26T22:26:04Z", + "modified": "2023-08-29T12:26:53Z", "published": "2017-11-29T23:19:51Z", "aliases": [ "CVE-2017-16833" ], - "summary": "Gemirro Stored Cross-site Scripting vulnerability", - "details": "Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javascript: URL in the \"homepage\" value of a \".gemspec\" file.", + "summary": "Gemirro Stored XSS in Gemspec \"homepage\" value", + "details": "Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javascript: URL in the \"homepage\" value of a \".gemspec\" file.\nA \".gemspec\" file must be created with a JavaScript URL in the homepage value. This can be used to build a gem for upload to the Gemirro server, in order to achieve stored XSS via the author name hyperlink.", "severity": [ { "type": "CVSS_V3", @@ -20,6 +20,11 @@ "ecosystem": "RubyGems", "name": "gemirro" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -47,6 +52,10 @@ { "type": "PACKAGE", "url": "https://github.com/PierreRambaud/gemirro" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/gemirro/CVE-2017-16833.yml" } ], "database_specific": {