GitHub Advisoryadvisory · RubyGems

GHSA-w7q9-xr2x-wh7x delayed_job_web Cross-site Scripting vulnerability

MEDIUM Published 2018-03-05 Modified 2023-08-29 Official page ↗
Aliases
CVE-2017-12097
Ecosystem
RubyGems
Packages
delayed_job_web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems delayed_job_web: >= 1.2.9, < 1.4.2 → fixed in 1.4.2

Description

An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem versions 1.2.9 before 1.4.2. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

Related

Alias · CVE (1)

  • CVE-2017-12097 An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References