CVEvulnerability
CVE-2009-3009
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-09-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.
Affected configurations
• rubyonrails rails 2.0.0
• rubyonrails rails 2.0.1
• rubyonrails rails 2.0.2
• rubyonrails rails 2.0.4
• rubyonrails rails 2.1.0
• rubyonrails rails 2.1.1
• rubyonrails rails 2.1.2
• rubyonrails rails 2.2.0
• rubyonrails rails 2.2.1
• rubyonrails rails 2.2.2
• rubyonrails rails 2.3.2
• rubyonrails rails 2.3.3
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 bugs.debian.org
- http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source Patch
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html lists.apple.com
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html lists.opensuse.org
- http://secunia.com/advisories/36600 Vendor Advisory
- http://secunia.com/advisories/36717 Vendor Advisory
- http://securitytracker.com/id?1022824 Patch
- http://support.apple.com/kb/HT4077 support.apple.com
- http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails weblog.rubyonrails.org
- http://www.debian.org/security/2009/dsa-1887 www.debian.org
- http://www.osvdb.org/57666 www.osvdb.org
- http://www.securityfocus.com/bid/36278 www.securityfocus.com
- http://www.vupen.com/english/advisories/2009/2544 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53036 exchange.xforce.ibmcloud.com
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 bugs.debian.org
- http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source Patch
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html lists.apple.com
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html lists.opensuse.org
- http://secunia.com/advisories/36600 Vendor Advisory
- http://secunia.com/advisories/36717 Vendor Advisory
- http://securitytracker.com/id?1022824 Patch
- http://support.apple.com/kb/HT4077 support.apple.com
- http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails weblog.rubyonrails.org
- http://www.debian.org/security/2009/dsa-1887 www.debian.org
- http://www.osvdb.org/57666 www.osvdb.org
- http://www.securityfocus.com/bid/36278 www.securityfocus.com
- http://www.vupen.com/english/advisories/2009/2544 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53036 exchange.xforce.ibmcloud.com