Lucene search

Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-5DF58F4224DFDBC08C90EB9B6C03F9D2

HistoryAug 10, 2012 - 12:00 a.m.

Ruby on Rails Potential XSS Vulnerability in select_tag prompt

2012-08-1000:00:00

https://gitlab.com/gitlab-org/security-products/gemnasium-db

gitlab.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

57.0%

JSON

When a value for the prompt field is supplied to the select_tag helper, the value is not escaped. If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks.

Affected configurations

Vulners

Node

gemactionpackRange3.0.0≥

gemactionpackRange<3.0.17

gemactionpackRange3.1.0≥

gemactionpackRange<3.1.8

gemactionpackRange3.2.0≥

gemactionpackRange<3.2.8

CPENameOperatorVersion
gem/actionpackge3.0.0
gem/actionpacklt3.0.17
gem/actionpackge3.1.0
gem/actionpacklt3.1.8
gem/actionpackge3.2.0
gem/actionpacklt3.2.8