Ubuntu.comUB:CVE-2017-12098CVE-2017-12098
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
40.8%
An exploitable cross site scripting (XSS) vulnerability exists in the add
filter functionality of the rails_admin rails gem version 1.2.0. A
specially crafted URL can cause an XSS flaw resulting in an attacker being
able to execute arbitrary javascript on the victim’s browser. An attacker
can phish an authenticated user to trigger this vulnerability.
Bugs
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | ruby-rails-admin | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | ruby-rails-admin | < any | UNKNOWN |
References
github.com/sferik/rails_admin/commit/44f09ed72b5e0e917a5d61bd89c48d97c494b41c
github.com/sferik/rails_admin/issues/2985
launchpad.net/bugs/cve/CVE-2017-12098
nvd.nist.gov/vuln/detail/CVE-2017-12098
security-tracker.debian.org/tracker/CVE-2017-12098
www.cve.org/CVERecord?id=CVE-2017-12098
www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
40.8%