Reflective XSS Vulnerability in Ruby on Rails

2013-12-0220:00:00

RubySec

rubysec.com

There is a vulnerability in the internationalization component of Ruby on
Rails. Under certain common configurations an attacker can provide specially
crafted input which will execute a reflective XSS attack.

The root cause of this issue is a vulnerability in the i18n gem which has
been assigned the identifier CVE-2013-4492.

CPENameOperatorVersion
actionpackle3.2.15
actionpackge3.3.0
actionpacklt4.0.2

Name	Operator	Version
actionpack	le	3.2.15
actionpack	ge	3.3.0
actionpack	lt	4.0.2

References

groups.google.com/forum/#!topic/ruby-security-ann/pLrh6DUw998

JSON

Related for RUBY:ACTIONPACK-2013-4491-100528