{"containers": {"cna": {"affected": [{"product": "sanitize (ruby gem)", "vendor": "Ryan Grove", "versions": [{"status": "affected", "version": "< 4.6.3"}]}], "datePublic": "2018-03-30T00:00:00", "descriptions": [{"lang": "en", "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-12-28T10:57:01", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"name": "DSA-4358", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2018/dsa-4358"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rgrove/sanitize/issues/176"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2018-3740", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "sanitize (ruby gem)", "version": {"version_data": [{"version_value": "< 4.6.3"}]}}]}, "vendor_name": "Ryan Grove"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)"}]}]}, "references": {"reference_data": [{"name": "DSA-4358", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4358"}, {"name": "https://github.com/rgrove/sanitize/issues/176", "refsource": "CONFIRM", "url": "https://github.com/rgrove/sanitize/issues/176"}, {"name": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/", "refsource": "CONFIRM", "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"}, {"name": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e", "refsource": "CONFIRM", "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T04:50:30.616Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-4358", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2018/dsa-4358"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/rgrove/sanitize/issues/176"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"}]}]}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2018-3740", "datePublished": "2018-03-30T19:00:00", "dateReserved": "2017-12-28T00:00:00", "dateUpdated": "2024-08-05T04:50:30.616Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "1F93BF3E-5C64-4376-9EE6-5638B5BCE8B8", "versionEndIncluding": "4.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element."}, {"lang": "es", "value": "Un fragmento HTML especialmente manipulado puede provocar que una gema Sanitize para Ruby permita que se utilicen atributos que no est\u00e1n en una lista blanca en un elemento HTML que s\u00ed est\u00e1 en una lista blanca."}], "id": "CVE-2018-3740", "lastModified": "2024-11-21T04:05:59.220", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2018-03-30T19:29:00.270", "references": [{"source": "[email protected]", "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"}, {"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/rgrove/sanitize/issues/176"}, {"source": "[email protected]", "url": "https://www.debian.org/security/2018/dsa-4358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/rgrove/sanitize/issues/176"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2018/dsa-4358"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "[email protected]", "type": "Primary"}]}

{}