GitHub Advisoryadvisory · RubyGems

GHSA-7g65-ghrg-hpf5 actionpack Cross-site Scripting vulnerability

MEDIUM Published 2017-10-24 Modified 2025-01-21 Official page ↗
Aliases
CVE-2012-3465
Ecosystem
RubyGems
Packages
actionpack
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems actionpack: >= 3.0.0.beta, < 3.0.17 → fixed in 3.0.17 • RubyGems actionpack: >= 3.1.0, < 3.1.8 → fixed in 3.1.8 • RubyGems actionpack: >= 3.2.0, < 3.2.8 → fixed in 3.2.8 • RubyGems actionpack: < 2.3.16 → fixed in 2.3.16

Description

Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/sanitize_helper.rb` in the `strip_tags` helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

Related

Alias · CVE (1)

  • CVE-2012-3465 Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References