Summary
It was discovered that YARD before 0.9.11 does not block relative paths
with an initial ../ sequence, which allows attackers to conduct
directory traversal attacks and read arbitrary files. This issue only
affected Ubuntu 16.04 LTS. (CVE-2017-17042)
It was discovered that yard before 0.9.20 is affected by a path
traversal vulnerability, allowing HTTP requests to access arbitrary
files under certain conditions. This issue only affected Ubuntu 18.04
LTS. (CVE-2019-1020001)
Aviv Keller discovered that the "frames.html" file within the Yard
Doc's generated documentation is vulnerable to Cross-Site Scripting
(XSS) attacks due to inadequate sanitization of user input within the
JavaScript segment of the "frames.erb" template file. (CVE-2024-27285)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | yard | 0.9.24-1+deb11u1build0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | yard | 0.9.26-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | yard | 0.8.7.6+git20160220-3ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | yard | 0.9.12-2ubuntu0.1~esm1 |
Vulnerabilities 3
-
High 7.5
Arbitrary file read vulnerability in yard server
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
-
High 7.5
Path Traversal vulnerability that affects yard
yard before 0.9.20 allows path traversal.
-
Medium 5.4
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template…