GitHub Advisoryadvisory · RubyGems
GHSA-pxr8-w3jq-rcwj rails_admin ruby gem XSS
MEDIUM
Official page ↗
- Aliases
- CVE-2017-12098
- Ecosystem
- RubyGems
- Packages
- rails_admin
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2020-06-16
Affected packages
• RubyGems rails_admin: < 1.3.0 → fixed in 1.3.0
Description
An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Related
Alias · CVE (1)
- CVE-2017-12098 An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-12098 advisory
- https://github.com/advisories/GHSA-pxr8-w3jq-rcwj advisory
- https://github.com/railsadminteam/rails_admin web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_admin/CVE-2017-12098.yml web
- https://web.archive.org/web/20210116160904/http://www.securityfocus.com/bid/102486 web
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450 web