GHSA-c289-47qf-rvrr

Cross Site Scripting (XSS) vulnerability in easymon

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000855

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	easymon	< 1.4.1	1.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000855 advisory
https://github.com/basecamp/easymon/issues/26 web
https://github.com/basecamp/easymon/pull/25 web
https://github.com/basecamp/easymon package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/easymon/CVE-2018-1000855.yml web