CVEvulnerability
CVE-2012-3464
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-08-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
Affected configurations
• rubyonrails rails 0.9.1
• rubyonrails rails 0.9.2
• rubyonrails rails 0.9.3
• rubyonrails rails 0.9.4
• rubyonrails rails 0.9.4.1
• rubyonrails rails 0.10.0
• rubyonrails rails 0.10.1
• rubyonrails rails 0.11.0
• rubyonrails rails 0.11.1
• rubyonrails rails 0.12.0
• rubyonrails rails 0.12.1
• rubyonrails rails 0.13.0
• rubyonrails rails 0.13.1
• rubyonrails rails 0.14.1
• rubyonrails rails 0.14.2
• rubyonrails rails 0.14.3
• rubyonrails rails 0.14.4
• rubyonrails rails 1.0.0
• rubyonrails rails 1.1.0
• rubyonrails rails 1.1.1
• rubyonrails rails 1.1.2
• rubyonrails rails 1.1.3
• rubyonrails rails 1.1.4
• rubyonrails rails 1.1.5
• rubyonrails rails 1.1.6
• rubyonrails rails 1.2.0
• rubyonrails rails 1.2.1
• rubyonrails rails 1.2.2
• rubyonrails rails 1.2.3
• rubyonrails rails 1.2.4
• rubyonrails rails 1.2.5
• rubyonrails rails 1.2.6
• rubyonrails rails 1.9.5
• rubyonrails rails 2.0.0
• rubyonrails rails 2.0.1
• rubyonrails rails 2.0.2
• rubyonrails rails 2.0.4
• rubyonrails rails 2.1.0
• rubyonrails rails 2.1.1
• rubyonrails rails 2.1.2
• rubyonrails rails 2.2.0
• rubyonrails rails 2.2.1
• rubyonrails rails 2.2.2
• rubyonrails rails 2.3.2
• rubyonrails rails 2.3.3
• rubyonrails rails 2.3.4
• rubyonrails rails 2.3.9
• rubyonrails rails 2.3.10
• rubyonrails rails 2.3.11
• rubyonrails rails 2.3.12
• rubyonrails rails 3.0.0
• rubyonrails rails 3.0.1
• rubyonrails rails 3.0.2
• rubyonrails rails 3.0.3
• rubyonrails rails 3.0.4
• rubyonrails rails 3.0.5
• rubyonrails rails 3.0.6
• rubyonrails rails 3.0.7
• rubyonrails rails 3.0.8
• rubyonrails rails 3.0.9
… and 33 more
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://rhn.redhat.com/errata/RHSA-2013-0154.html rhn.redhat.com
- http://secunia.com/advisories/50694 secunia.com
- http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ Vendor Advisory
- https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source&output=gplain groups.google.com
- http://rhn.redhat.com/errata/RHSA-2013-0154.html rhn.redhat.com
- http://secunia.com/advisories/50694 secunia.com
- http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ Vendor Advisory
- https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source&output=gplain groups.google.com