CVE-2017-16792: Cross-site Scripting

November 13, 2017 (updated September 26, 2019)

A stored cross-site scripting (XSS) vulnerability in geminabox (Gem in a Box) allows attackers to inject arbitrary web script via the homepage value of a .gemspec file, related to views/gem.erb and views/index.erb.

References

github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7
nvd.nist.gov/vuln/detail/CVE-2017-16792

Code Behaviors & Features

Detect and mitigate CVE-2017-16792 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →