GitHub Advisoryadvisory · RubyGems

GHSA-8qrh-h9m2-5fvf Cross site scripting that affects rails

MEDIUM Published 2017-10-24 Modified 2025-04-09 Official page ↗
Aliases
CVE-2009-3009
Ecosystem
RubyGems
Packages
actionpack, activesupport
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems actionpack: >= 2.0.0, < 2.2.3 → fixed in 2.2.3 • RubyGems actionpack: >= 2.3.0, < 2.3.4 → fixed in 2.3.4 • RubyGems activesupport: >= 2.0.0, < 2.2.3 → fixed in 2.2.3 • RubyGems activesupport: >= 2.3.0, < 2.3.4 → fixed in 2.3.4

Description

Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

Related

Alias · CVE (1)

  • CVE-2009-3009 Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References