Vulnerable Library - rexml-3.2.6.gem
An XML toolkit for Ruby
Library home page: https://rubygems.org/gems/rexml-3.2.6.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.2.6.gem
Vulnerabilities
| CVE |
Severity |
 CVSS |
Exploit Maturity |
EPSS |
Dependency |
Type |
Fixed in (rexml version) |
Remediation Possible** |
Reachability |
| CVE-2024-35176 |
 Medium |
5.3 |
Not Defined |
0.0% |
rexml-3.2.6.gem |
Direct |
rexml - 3.2.7 |
✅ |
|
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-35176
Vulnerable Library - rexml-3.2.6.gem
An XML toolkit for Ruby
Library home page: https://rubygems.org/gems/rexml-3.2.6.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.2.6.gem
Dependency Hierarchy:
- ❌ rexml-3.2.6.gem (Vulnerable Library)
Found in base branch: main
Vulnerability Details
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many <s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
Publish Date: 2024-05-16
URL: CVE-2024-35176
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.0%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-vg3r-rm7w-2xgh
Release Date: 2024-05-16
Fix Resolution: rexml - 3.2.7
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules
An XML toolkit for Ruby
Library home page: https://rubygems.org/gems/rexml-3.2.6.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.2.6.gem
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - rexml-3.2.6.gem
An XML toolkit for Ruby
Library home page: https://rubygems.org/gems/rexml-3.2.6.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.2.6.gem
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many
<s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.Publish Date: 2024-05-16
URL: CVE-2024-35176
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.0%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-vg3r-rm7w-2xgh
Release Date: 2024-05-16
Fix Resolution: rexml - 3.2.7
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules