{"id":"GHSA-m3q7-rj8g-m457","summary":"ember-source Cross-site Scripting vulnerability","details":"Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.","aliases":["CVE-2015-7565"],"modified":"2024-02-16T08:06:35.628087Z","published":"2018-08-28T22:33:24Z","database_specific":{"github_reviewed_at":"2020-06-16T21:44:43Z","nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7565"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ember-source/CVE-2015-7565.yml"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY"},{"type":"WEB","url":"http://emberjs.com/blog/2016/01/14/security-releases-ember-1-11-4-1-12-2-1-13-12-2-0-3-2-1-2-2-2-1.html"}],"affected":[{"package":{"name":"ember-source","ecosystem":"RubyGems","purl":"pkg:gem/ember-source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.11.4"}]}],"versions":["1.10.0","1.10.0.beta.1","1.10.0.beta.2","1.10.0.beta.3","1.10.0.beta.4","1.10.1","1.11.0","1.11.0.1","1.11.0.beta.1","1.11.0.beta.2","1.11.0.beta.2.1","1.11.0.beta.2.2","1.11.0.beta.3","1.11.0.beta.4","1.11.0.beta.5","1.11.1","1.11.3","1.11.3.1","1.8.0","1.8.1","1.9.0","1.9.0.alpha","1.9.0.alpha.2","1.9.0.beta.1","1.9.0.beta.1.1","1.9.0.beta.3","1.9.0.beta.4","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-m3q7-rj8g-m457/GHSA-m3q7-rj8g-m457.json"}},{"package":{"name":"ember-source","ecosystem":"RubyGems","purl":"pkg:gem/ember-source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.2"}]}],"versions":["1.12.0","1.12.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-m3q7-rj8g-m457/GHSA-m3q7-rj8g-m457.json"}},{"package":{"name":"ember-source","ecosystem":"RubyGems","purl":"pkg:gem/ember-source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.12"}]}],"versions":["1.13.0","1.13.1","1.13.1.1","1.13.10","1.13.11","1.13.2","1.13.3","1.13.4","1.13.4.1","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-m3q7-rj8g-m457/GHSA-m3q7-rj8g-m457.json"}},{"package":{"name":"ember-source","ecosystem":"RubyGems","purl":"pkg:gem/ember-source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}],"versions":["2.0.0","2.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-m3q7-rj8g-m457/GHSA-m3q7-rj8g-m457.json"}},{"package":{"name":"ember-source","ecosystem":"RubyGems","purl":"pkg:gem/ember-source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-m3q7-rj8g-m457/GHSA-m3q7-rj8g-m457.json"}},{"package":{"name":"ember-source","ecosystem":"RubyGems","purl":"pkg:gem/ember-source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-m3q7-rj8g-m457/GHSA-m3q7-rj8g-m457.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}