GitHub Advisoryadvisory · RubyGems

GHSA-qv8p-v9qw-wc7g activesupport Cross-site Scripting vulnerability

MEDIUM Published 2017-10-24 Modified 2023-01-23 Official page ↗
Aliases
CVE-2012-1098
Ecosystem
RubyGems
Packages
activesupport
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems activesupport: >= 3.0.0, < 3.0.12 → fixed in 3.0.12 • RubyGems activesupport: >= 3.1.0, < 3.1.4 → fixed in 3.1.4 • RubyGems activesupport: >= 3.2.0, < 3.2.2 → fixed in 3.2.2

Description

Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.

Related

Alias · CVE (1)

  • CVE-2012-1098 Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References