Medium · 6.1 CVE-2018-3769 EUVD-2018-0396GHSA-f599-5m7p-hcpf

grape subject to Cross-site Scripting

Published Jul 5, 2018 · Updated Aug 5, 2024 · Assigned by hackerone

Vendor: Ruby Grape Product: ruby-grape ruby gem Package: grape Package: ruby-grape Package: ruby-grape Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.

Affected products

Vendor	Product	Affected	Fixed
Ruby Grape	ruby-grape ruby gem	>= 1.0.3	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	ruby-grape	1.1.0-1	—

Ubuntu