Cross-site Scripting in loofah

🗓️ 21 Mar 2018 11:57:11Reported by GitHub Advisory DatabaseType

Loofah allows non-whitelisted attributes in sanitized output

Reporter	Title	Published	Views	Family All 96
FreeBSD	rails-html-sanitizer -- possible XSS vulnerability	22 Mar 201800:00	–	freebsd
FreeBSD	Loofah -- XSS vulnerability	15 Mar 201800:00	–	freebsd
CNVD	Ruby Loofah gem cross-site scripting vulnerability	26 Mar 201800:00	–	cnvd
CVE	CVE-2018-8048	27 Mar 201817:00	–	cve
Cvelist	CVE-2018-8048	27 Mar 201817:00	–	cvelist
Debian	[SECURITY] [DSA 4171-1] ruby-loofah security update	13 Apr 201819:12	–	debian
Debian	[SECURITY] [DSA 4171-1] ruby-loofah security update	13 Apr 201819:12	–	debian
Debian CVE	CVE-2018-8048	27 Mar 201817:00	–	debiancve
Tenable Nessus	Debian DSA-4171-1 : ruby-loofah - security update	16 Apr 201800:00	–	nessus
Tenable Nessus	FreeBSD : Loofah -- XSS vulnerability (ba6d0c9b-f5f6-4b9b-a6de-3cce93c83220)	21 Mar 201800:00	–	nessus

Vulners

Node

nokogiri nokogiriRange<1.8.3rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-8048
github	www.github.com/flavorjones/loofah/issues/144
github	www.github.com/advisories/GHSA-x7rv-cr6v-4vm4
security	www.security.netapp.com/advisory/ntap-20191122-0003/
debian	www.debian.org/security/2018/dsa-4171
openwall	www.openwall.com/lists/oss-security/2018/03/19/5
github	www.github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116
github	www.github.com/sparklemotion/nokogiri/pull/1746
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml

05 Jul 2023 20:45Current

6.4Medium risk

Vulners AI Score6.4

CVSS 24.3

CVSS 36.1

EPSS0.00689