GitHub Advisoryadvisory · RubyGems

GHSA-r53w-g4xm-3gc6 Haml vulnerable to cross-site scripting

MEDIUM Published 2019-10-21 Modified 2023-08-25 Official page ↗
Aliases
CVE-2017-1002201
Ecosystem
RubyGems
Packages
haml
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-10-16

Affected packages

• RubyGems haml: < 5.0.0 → fixed in 5.0.0

Description

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like ` " '` must be escaped properly. In this case, the `'` character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.

Related

Alias · CVE (1)

  • CVE-2017-1002201 In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References