Lucene search
Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-5FD0ABE36E2EEE52D6830B6D79C4317DHistoryNov 28, 2011 - 12:00 a.m.
Translate helper method which may allow an attacker to insert arbitrary code into a page
2011-11-2800:00:00
https://gitlab.com/gitlab-org/security-products/gemnasium-db
gitlab.com
16
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
69.5%
The helper method for i18n translations has a convention whereby translations strings with a name ending in ‘html’ are considered HTML safe. There is also a mechanism for interpolation. It has been discovered that these ‘html’ strings allow arbitrary values to be contained in the interpolated input, and these values are not escaped.
Affected configurations
Node
gemactionpackRange3.0.0.alpha0≥
ORgemactionpackRange<3.0.11
ORgemactionpackRange3.1.0.alpha0≥
ORgemactionpackRange<3.1.2
| CPE | Name | Operator | Version |
|---|---|---|---|
| gem/actionpack | ge | 3.0.0.alpha0 | |
| gem/actionpack | lt | 3.0.11 | |
| gem/actionpack | ge | 3.1.0.alpha0 | |
| gem/actionpack | lt | 3.1.2 |
Related
cvelist
cvelist
CVE-2011-4319
2011-11-28 11:00:00
cve
cve
CVE-2011-4319
2011-11-28 11:55:09
openvas
openvas
Fedora Update for rubygem-actionpack FEDORA-2012-0643
2012-03-19 00:00:00
Fedora Update for rubygem-actionpack FEDORA-2012-0643
2012-03-19 00:00:00
Fedora Update for rubygem-actionpack FEDORA-2012-0626
2012-02-01 00:00:00
osv
osv
Cross-site Scripting vulnerability in i18n translations helper method
2017-10-24 18:33:38
ubuntucve
ubuntucve
CVE-2011-4319
2011-11-28 00:00:00
nvd
nvd
CVE-2011-4319
2011-11-28 11:55:09
github
github
Cross-site Scripting vulnerability in i18n translations helper method
2017-10-24 18:33:38
debiancve
debiancve
CVE-2011-4319
2011-11-28 11:55:09
prion
prion
Cross site scripting
2011-11-28 11:55:00
fedora
fedora
[SECURITY] Fedora 16 Update: rubygem-actionpack-3.0.10-2.fc16
2012-01-25 22:34:25
[SECURITY] Fedora 15 Update: rubygem-actionpack-3.0.5-5.fc15
2012-01-25 22:34:43
[SECURITY] Fedora 15 Update: rubygem-actionpack-3.0.5-6.fc15
2012-03-17 23:51:39
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
69.5%
Related for GITLAB-5FD0ABE36E2EEE52D6830B6D79C4317D