Lucene search

RubySecRUBY:ACTIONPACK-2011-2197

HistoryOct 23, 2017 - 9:00 p.m.

Potential XSS Vulnerability in Ruby on Rails Applications

2017-10-2321:00:00

RubySec

weblog.rubyonrails.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x
before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does
not properly handle mutation of safe buffers, which makes it easier
for remote attackers to conduct XSS attacks via crafted strings to an
application that uses a problematic string method, as demonstrated
by the sub method.

Affected configurations

Vulners

Node

rubyactionpackRange2.3.0–2.3.12

rubyactionpackRange≤3.0.8

VendorProductVersionCPE
rubyactionpack*cpe:2.3:a:ruby:actionpack:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ruby	actionpack	*	cpe:2.3:a:ruby:actionpack::::::::

References

weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

Related for RUBY:ACTIONPACK-2011-2197