Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ed6k-yw87-s3cw
Vulnerability ID VCID-ed6k-yw87-s3cw
Aliases CVE-2024-27285
GHSA-8mq4-9jjh-9xrc
Summary
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27285.json
epss 0.03316 https://api.first.org/data/v1/epss?cve=CVE-2024-27285
epss 0.03316 https://api.first.org/data/v1/epss?cve=CVE-2024-27285
cvssv3.1 5.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 5.4 https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
cvssv3.1 5.4 https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
generic_textual MODERATE https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
cvssv3.1 5.4 https://github.com/lsegal/yard
generic_textual MODERATE https://github.com/lsegal/yard
cvssv3.1 5.4 https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
generic_textual MODERATE https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
ssvc Track https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
cvssv3.1 5.4 https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
generic_textual MODERATE https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
ssvc Track https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
cvssv3.1 5.4 https://github.com/lsegal/yard/pull/1538
generic_textual MODERATE https://github.com/lsegal/yard/pull/1538
ssvc Track https://github.com/lsegal/yard/pull/1538
cvssv3.1 5.4 https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
cvssv3.1_qr MODERATE https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
generic_textual MODERATE https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
ssvc Track https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
cvssv3.1 5.4 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
ssvc Track https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
cvssv3.1 5.4 https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
cvssv3.1 5.4 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA
cvssv3.1 5.4 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2024-27285
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-27285
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27285.json
https://api.first.org/data/v1/epss?cve=CVE-2024-27285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27285
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/lsegal/yard
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA
1065118 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1065118
1538 https://github.com/lsegal/yard/pull/1538
1fcb2d8b316caf8779cfdcf910715e9ab583f0aa https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
2069e2bf08293bda2fcc78f7d0698af6354054be https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
2267244 https://bugzilla.redhat.com/show_bug.cgi?id=2267244
CVE-2024-27285 https://nvd.nist.gov/vuln/detail/CVE-2024-27285
CVE-2024-27285.yml https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
GHSA-8mq4-9jjh-9xrc https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
GHSA-8mq4-9jjh-9xrc https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/
msg00006.html https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
USN-6731-1 https://usn.ubuntu.com/6731-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27285.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/lsegal/yard
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-29T20:48:49Z/ Found at https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-29T20:48:49Z/ Found at https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/lsegal/yard/pull/1538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-29T20:48:49Z/ Found at https://github.com/lsegal/yard/pull/1538
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-29T20:48:49Z/ Found at https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-29T20:48:49Z/ Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-29T20:48:49Z/ Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-29T20:48:49Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-27285
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.87539
EPSS Score 0.03316
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:11:11.494354+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 38.6.0