{"id":"CVE-2017-14683","published":"2017-09-25T08:00:00Z","modified":"2024-08-05T19:34:39Z","title":"geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload","vendor":null,"product":null,"tier":"tail","description":{"text":"geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00496,"percentile":0.42416,"provenance":"source"},"cwes":[],"references":[{"url":"http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html","tags":["x_refsource_MISC"]},{"url":"https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md","tags":["x_refsource_MISC"]}],"priority":{"score":8.5,"factors":[{"name":"EPSS percentile","points":8.48}]},"affected":[{"ecosystem":"RubyGems","package":"geminabox","vulnerableRanges":["<0.13.7"],"patched":["0.13.7"],"from":["GHSA-qwv2-2x8g-g43g"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5050","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-geminabox-cve-2017-14506","parents":[{"from":"CVE-2017-14506","to":"CVE-2017-14683","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:geminabox","fromFixed":"0.13.6","toFixed":"0.13.7","daysApart":0},{"kind":"same-code","provenance":"machine","files":["lib/geminabox/server.rb"],"commits":["https://github.com/geminabox/geminabox/commit/99aaae196c4fc6ae0df28e186ca1e493ae658e02","https://github.com/geminabox/geminabox/commit/a01c4e8b3403624109499dec75eb6ee30bd01a55"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.73,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2017-14683","to":"CVE-2017-16792","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:geminabox","fromFixed":"0.13.7","toFixed":"0.13.10","daysApart":49},{"kind":"same-code","provenance":"machine","files":["lib/geminabox/server.rb"],"commits":["https://github.com/geminabox/geminabox/commit/a01c4e8b3403624109499dec75eb6ee30bd01a55","https://github.com/geminabox/geminabox/commit/f8429a9e364658459add170e4ebc7a5d3b4759e7"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.51,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2017-14506","published":"2017-09-25","fixed":"0.13.6","kev":false},{"cve":"CVE-2017-14683","published":"2017-09-25","fixed":"0.13.7","kev":false},{"cve":"CVE-2017-16792","published":"2017-11-13","fixed":"0.13.10","kev":false}],"package":"RubyGems:geminabox"}}