Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2009-4214
HistoryDec 07, 2009 - 5:30 p.m.

CVE-2009-4214

2009-12-0717:30:00
CWE-79
[email protected]
web.nvd.nist.gov
70
cve
2009
4214
cross-site scripting
xss
vulnerability
ruby on rails
html::tokenizer
actionpack
html scanner
remote attackers
web script
html
ascii characters
nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

7.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.7%

JSON

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

Affected configurations

NVD
Node
rubyonrailsrailsMatch2.3.2
OR
rubyonrailsrailsMatch2.3.3
OR
rubyonrailsrailsMatch2.3.4
Node
rubyonrailsrailsMatch0.9.1
OR
rubyonrailsrailsMatch0.9.2
OR
rubyonrailsrailsMatch0.9.3
OR
rubyonrailsrailsMatch0.9.4
OR
rubyonrailsrailsMatch0.9.4.1
OR
rubyonrailsrailsMatch0.10.0
OR
rubyonrailsrailsMatch0.10.1
OR
rubyonrailsrailsMatch0.11.0
OR
rubyonrailsrailsMatch0.11.1
OR
rubyonrailsrailsMatch0.12.0
OR
rubyonrailsrailsMatch0.12.1
OR
rubyonrailsrailsMatch0.13.0
OR
rubyonrailsrailsMatch0.13.1
OR
rubyonrailsrailsMatch0.14.1
OR
rubyonrailsrailsMatch0.14.2
OR
rubyonrailsrailsMatch0.14.3
OR
rubyonrailsrailsMatch0.14.4
OR
rubyonrailsrailsMatch1.0.0
OR
rubyonrailsrailsMatch1.1.0
OR
rubyonrailsrailsMatch1.1.1
OR
rubyonrailsrailsMatch1.1.2
OR
rubyonrailsrailsMatch1.1.3
OR
rubyonrailsrailsMatch1.1.4
OR
rubyonrailsrailsMatch1.1.5
OR
rubyonrailsrailsMatch1.1.6
OR
rubyonrailsrailsMatch1.2.0
OR
rubyonrailsrailsMatch1.2.1
OR
rubyonrailsrailsMatch1.2.2
OR
rubyonrailsrailsMatch1.2.3
OR
rubyonrailsrailsMatch1.2.4
OR
rubyonrailsrailsMatch1.2.5
OR
rubyonrailsrailsMatch1.2.6
OR
rubyonrailsrailsMatch1.9.5
OR
rubyonrailsrailsMatch2.0.0
OR
rubyonrailsrailsMatch2.0.0rc1
OR
rubyonrailsrailsMatch2.0.0rc2
OR
rubyonrailsrailsMatch2.0.1
OR
rubyonrailsrailsMatch2.0.2
OR
rubyonrailsrailsMatch2.0.4
OR
rubyonrailsrailsMatch2.1.0
OR
rubyonrailsrailsMatch2.1.1
OR
rubyonrailsruby_on_railsRange≤2.1.2
OR
rubyonrailsruby_on_railsMatch0.5.0
OR
rubyonrailsruby_on_railsMatch0.5.5
OR
rubyonrailsruby_on_railsMatch0.5.6
OR
rubyonrailsruby_on_railsMatch0.5.7
OR
rubyonrailsruby_on_railsMatch0.6.0
OR
rubyonrailsruby_on_railsMatch0.6.5
OR
rubyonrailsruby_on_railsMatch0.7.0
OR
rubyonrailsruby_on_railsMatch0.8.0
OR
rubyonrailsruby_on_railsMatch0.8.5
OR
rubyonrailsruby_on_railsMatch0.9.0

Related

nessus 12
openvas 17
fedora 3
debiancve 1
github 1
ubuntucve 1
nvd 2
cvelist 1
osv 4
prion 1
cve 1
debian 3
securityvulns 2
gentoo 1
threatpost 1
nessus
nessus
Fedora 11 : rubygem-actionpack-2.3.2-4.fc11 (2009-13361)
2009-12-18 00:00:00
Fedora 10 : rubygem-actionpack-2.1.1-5.fc10 (2009-12966)
2009-12-10 00:00:00
Fedora 12 : rubygem-actionpack-2.3.4-3.fc12 (2009-13393)
2009-12-18 00:00:00
openvas
openvas
Ruby on Rails 'strip_tags' Cross Site Scripting Vulnerability
2009-12-09 00:00:00
Fedora Core 12 FEDORA-2009-13393 (rubygem-actionpack)
2009-12-30 00:00:00
Fedora Core 12 FEDORA-2009-13393 (rubygem-actionpack)
2009-12-30 00:00:00
fedora
fedora
[SECURITY] Fedora 12 Update: rubygem-actionpack-2.3.4-3.fc12
2009-12-18 04:46:05
[SECURITY] Fedora 11 Update: rubygem-actionpack-2.3.2-4.fc11
2009-12-18 04:36:01
[SECURITY] Fedora 10 Update: rubygem-actionpack-2.1.1-5.fc10
2009-12-10 04:12:27
debiancve
debiancve
CVE-2009-4214
2009-12-07 17:30:00
github
github
Moderate severity vulnerability that affects rails
2017-10-24 18:33:38
ubuntucve
ubuntucve
CVE-2009-4214
2009-12-07 00:00:00
nvd
nvd
CVE-2009-4214
2009-12-07 17:30:00
CVE-2009-4132
2009-12-12 02:30:01
cvelist
cvelist
CVE-2009-4214
2009-12-07 17:00:00
osv
osv
Moderate severity vulnerability that affects rails
2017-10-24 18:33:38
rails - several
2011-06-14 00:00:00
rails - several
2012-01-23 00:00:00
prion
prion
Cross site scripting
2009-12-07 17:30:00
cve
cve
CVE-2009-4132
2022-10-03 16:24:05
debian
debian
[SECURITY] [DSA 2259-1] rails security update
2011-06-14 18:57:49
[SECURITY] [DSA 2301-1] rails security update
2011-09-05 20:25:54
[SECURITY] [DSA 2301-2] rails regression
2012-01-23 18:35:53
securityvulns
securityvulns
[SECURITY] [DSA 2301-1] rails security update
2011-09-09 00:00:00
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2011-09-09 00:00:00
gentoo
gentoo
Ruby on Rails: Multiple vulnerabilities
2009-12-20 00:00:00
threatpost
threatpost
Apple Mega Patch Covers 88 Mac OS X Vulnerabilities
2010-03-29 17:15:44

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

7.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.7%

JSON
Related for CVE-2009-4214
nessus12openvas17fedora3debiancve1github1ubuntucve1nvd2cvelist1osv4prion1cve1debian3securityvulns2gentoo1threatpost1