CVE-2013-1855

2013-03-1922:55:00

CWE-79

[email protected]

web.nvd.nist.gov

ruby on rails

action pack

xss

cve-2013-1855

cross-site scripting

nvd

5.4 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

73.5%

JSON

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

CPENameOperatorVersion
rubyonrails:railsrubyonrails railseq3.2.0
rubyonrails:railsrubyonrails railseq3.2.7
rubyonrails:railsrubyonrails railseq3.2.8
rubyonrails:railsrubyonrails railseq3.2.9
rubyonrails:railsrubyonrails railseq3.2.1
rubyonrails:railsrubyonrails railseq3.2.5
rubyonrails:railsrubyonrails railseq3.2.6
rubyonrails:railsrubyonrails railseq3.2.10
rubyonrails:railsrubyonrails railseq3.2.11
rubyonrails:railsrubyonrails railseq3.2.12

CPE	Name	Operator	Version
rubyonrails:rails	rubyonrails rails	eq	3.2.0
rubyonrails:rails	rubyonrails rails	eq	3.2.7
rubyonrails:rails	rubyonrails rails	eq	3.2.8
rubyonrails:rails	rubyonrails rails	eq	3.2.9
rubyonrails:rails	rubyonrails rails	eq	3.2.1
rubyonrails:rails	rubyonrails rails	eq	3.2.5
rubyonrails:rails	rubyonrails rails	eq	3.2.6
rubyonrails:rails	rubyonrails rails	eq	3.2.10
rubyonrails:rails	rubyonrails rails	eq	3.2.11
rubyonrails:rails	rubyonrails rails	eq	3.2.12