GitHub Advisoryadvisory · RubyGems

GHSA-4whc-pp4x-9pf3 jquery-rails and jquery-ujs subject to Exposure of Sensitive Information

MEDIUM Published 2017-10-24 Modified 2026-01-14 Official page ↗
Aliases
CVE-2015-1840
Ecosystem
RubyGems
Packages
jquery-rails, jquery-ujs
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• RubyGems jquery-rails: < 3.1.3 → fixed in 3.1.3 • RubyGems jquery-rails: >= 4.0.0, < 4.0.4 → fixed in 4.0.4 • RubyGems jquery-ujs: < 1.0.4 → fixed in 1.0.4

Description

jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.

Related

Alias · CVE (1)

  • CVE-2015-1840 jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References