GitHub Advisoryadvisory · RubyGems

GHSA-2xjj-5x6h-8vmf Cross-site Scripting in actionpack

MEDIUM Published 2017-10-24 Modified 2023-08-25 Official page ↗
Aliases
CVE-2012-1099
Ecosystem
RubyGems
Packages
actionpack
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems actionpack: >= 3.0.0, < 3.0.12 → fixed in 3.0.12 • RubyGems actionpack: >= 3.1.0, < 3.1.4 → fixed in 3.1.4 • RubyGems actionpack: >= 3.2.0, < 3.2.2 → fixed in 3.2.2

Description

Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_options_helper.rb` in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.

Related

Alias · CVE (1)

  • CVE-2012-1099 Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References