grape subject to Cross-site Scripting · CVE-2018-3769 · GitHub Advisory Database · GitHub

grape subject to Cross-site Scripting

Moderate severity GitHub Reviewed Published Aug 13, 2018 to the GitHub Advisory Database • Updated Mar 14, 2023

Package

grape (RubyGems)

Affected versions

< 1.1.0

Patched versions

1.1.0

Description

The grape rubygem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.

References

Published by the National Vulnerability Database

Jul 5, 2018

Published to the GitHub Advisory Database Aug 13, 2018

Reviewed Jun 16, 2020

Last updated Mar 14, 2023

Severity

Moderate

6.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N