Lucene search
Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-7F6090ADECE07680253A38D404FF6FB0HistoryAug 10, 2012 - 12:00 a.m.
Potential XSS Vulnerability in Ruby on Rails
2012-08-1000:00:00
https://gitlab.com/gitlab-org/security-products/gemnasium-db
gitlab.com
16
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
59.7%
The HTML escaping code in Ruby on Rails does not escape all potentially dangerous characters. In particular the code does not escape the single quote character. The helpers used in Rails itself never use single quotes, so most applications are unlikely to be vulnerable, however all users running an affected release should still upgrade.
| CPE | Name | Operator | Version |
|---|---|---|---|
| gem/activesupport | lt | 3.0.17 | |
| gem/activesupport | ge | 3.1.0 | |
| gem/activesupport | lt | 3.1.8 | |
| gem/activesupport | ge | 3.2.0 | |
| gem/activesupport | lt | 3.2.8 |
Related
nessus
nessus
Fedora 17 : rubygem-activesupport-3.0.11-6.fc17 (2012-11888)
2012-08-23 00:00:00
Fedora 16 : rubygem-activesupport-3.0.10-4.fc16 (2012-11880)
2012-08-23 00:00:00
osv
osv
activesupport Cross-site Scripting vulnerability
2017-10-24 18:33:37
fedora
fedora
[SECURITY] Fedora 17 Update: rubygem-activesupport-3.0.11-6.fc17
2012-08-22 21:12:40
[SECURITY] Fedora 16 Update: rubygem-activesupport-3.0.10-4.fc16
2012-08-22 21:13:38
[SECURITY] Fedora 17 Update: rubygem-activesupport-3.0.11-7.fc17
2013-01-23 01:53:38
openvas
openvas
Fedora Update for rubygem-activesupport FEDORA-2012-11888
2012-08-30 00:00:00
Fedora Update for rubygem-activesupport FEDORA-2012-11888
2012-08-30 00:00:00
Fedora Update for rubygem-activesupport FEDORA-2012-11880
2012-08-24 00:00:00
cve
cve
CVE-2012-3464
2012-08-10 10:34:00
prion
prion
Cross site scripting
2012-08-10 10:34:00
debiancve
debiancve
CVE-2012-3464
2012-08-10 10:34:00
ubuntucve
ubuntucve
CVE-2012-3464
2012-08-10 00:00:00
github
github
activesupport Cross-site Scripting vulnerability
2017-10-24 18:33:37
rubygems
rubygems
CVE-2012-3464 rubygem-actionpack: potential XSS vulnerability
2012-08-08 20:00:00
freebsd
freebsd
rubygem-rails -- multiple vulnerabilities
2012-08-08 00:00:00
debian
debian
[SECURITY] [DSA 2655-1] rails security update
2013-03-28 16:15:56
redhat
redhat
(RHSA-2013:0154) Critical: Ruby on Rails security update
2013-01-10 20:37:00
(RHSA-2013:0582) Moderate: Red Hat OpenShift Enterprise 1.1.1 update
2013-02-28 00:00:00
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
59.7%
Related for GITLAB-7F6090ADECE07680253A38D404FF6FB0