{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22048", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2024-01-04T18:44:53.107Z", "datePublished": "2024-01-04T20:39:59.670Z", "dateUpdated": "2024-09-04T20:29:59.164Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://rubygems.org", "defaultStatus": "unaffected", "packageName": "govuk_tech_docs", "versions": [{"lessThan": "3.3.1", "status": "affected", "version": "2.0.2", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.</p>"}], "value": "govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.\n\n"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-01-04T20:39:59.670Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773"}, {"tags": ["patch"], "url": "https://github.com/alphagov/tech-docs-gem/pull/323"}, {"tags": ["related"], "url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1"}, {"tags": ["third-party-advisory"], "url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773"}, {"tags": ["third-party-advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773"}], "source": {"discovery": "INTERNAL"}, "title": "govuk_tech_docs XSS Vulnerability"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.627Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773"}, {"tags": ["patch", "x_transferred"], "url": "https://github.com/alphagov/tech-docs-gem/pull/323"}, {"tags": ["related", "x_transferred"], "url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-13T18:55:05.958271Z", "id": "CVE-2024-22048", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T20:29:59.164Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://github.com/alphagov/tech-docs-gem/pull/323", "tags": ["patch", "x_transferred"]}, {"url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1", "tags": ["related", "x_transferred"]}, {"url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.627Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22048", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-13T18:55:05.958271Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T20:27:48.799Z"}}], "cna": {"title": "govuk_tech_docs XSS Vulnerability", "source": {"discovery": "INTERNAL"}, "affected": [{"versions": [{"status": "affected", "version": "2.0.2", "lessThan": "3.3.1", "versionType": "semver"}], "packageName": "govuk_tech_docs", "collectionURL": "https://rubygems.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773", "tags": ["vendor-advisory"]}, {"url": "https://github.com/alphagov/tech-docs-gem/pull/323", "tags": ["patch"]}, {"url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1", "tags": ["related"]}, {"url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773", "tags": ["third-party-advisory"]}, {"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-01-04T20:39:59.670Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22048", "state": "PUBLISHED", "dateUpdated": "2024-09-04T20:29:59.164Z", "dateReserved": "2024-01-04T18:44:53.107Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2024-01-04T20:39:59.670Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gov.uk:govuk_tech_docs:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "6D17958B-199F-4DC7-B7A3-2A1D07C4BDA7", "versionEndExcluding": "3.3.1", "versionStartIncluding": "2.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.\n\n"}, {"lang": "es", "value": "Las versiones de govuk_tech_docs desde la 2.0.2 hasta la 3.3.1 anteriores son afectados por una vulnerabilidad de cross site scripting. Se puede ejecutar JavaScript malicioso en el navegador del usuario si se muestra un resultado de b\u00fasqueda malicioso en la p\u00e1gina de b\u00fasqueda."}], "id": "CVE-2024-22048", "lastModified": "2024-11-21T08:55:27.533", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-04T21:15:09.940", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/alphagov/tech-docs-gem/pull/323"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1"}, {"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/alphagov/tech-docs-gem/pull/323"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes"], "url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}