4.3

CVE-2011-2197

The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version 2.0.0
Rubyonrails ≫ Rails Version 2.0.0 Update rc1
Rubyonrails ≫ Rails Version 2.0.0 Update rc2
Rubyonrails ≫ Rails Version 2.0.1
Rubyonrails ≫ Rails Version 2.0.2
Rubyonrails ≫ Rails Version 2.0.4
Rubyonrails ≫ Rails Version 2.1.0
Rubyonrails ≫ Rails Version 2.1.1
Rubyonrails ≫ Rails Version 2.1.2
Rubyonrails ≫ Rails Version 2.2.0
Rubyonrails ≫ Rails Version 2.2.1
Rubyonrails ≫ Rails Version 2.2.2
Rubyonrails ≫ Rails Version 2.3.2
Rubyonrails ≫ Rails Version 2.3.3
Rubyonrails ≫ Rails Version 2.3.4
Rubyonrails ≫ Rails Version 2.3.9
Rubyonrails ≫ Rails Version 2.3.10
Rubyonrails ≫ Rails Version 2.3.11
Rubyonrails ≫ Rails Version 3.0.0
Rubyonrails ≫ Rails Version 3.0.0 Update beta
Rubyonrails ≫ Rails Version 3.0.0 Update beta2
Rubyonrails ≫ Rails Version 3.0.0 Update beta3
Rubyonrails ≫ Rails Version 3.0.0 Update beta4
Rubyonrails ≫ Rails Version 3.0.0 Update rc
Rubyonrails ≫ Rails Version 3.0.0 Update rc2
Rubyonrails ≫ Rails Version 3.0.1
Rubyonrails ≫ Rails Version 3.0.1 Update pre
Rubyonrails ≫ Rails Version 3.0.2
Rubyonrails ≫ Rails Version 3.0.2 Update pre
Rubyonrails ≫ Rails Version 3.0.3
Rubyonrails ≫ Rails Version 3.0.4 Update rc1
Rubyonrails ≫ Rails Version 3.0.5
Rubyonrails ≫ Rails Version 3.0.5 Update rc1
Rubyonrails ≫ Rails Version 3.0.6
Rubyonrails ≫ Rails Version 3.0.6 Update rc1
Rubyonrails ≫ Rails Version 3.0.6 Update rc2
Rubyonrails ≫ Rails Version 3.0.7
Rubyonrails ≫ Rails Version 3.0.7 Update rc1
Rubyonrails ≫ Rails Version 3.0.7 Update rc2
Rubyonrails ≫ Rails Version 3.0.8 Update rc1
Rubyonrails ≫ Rails Version 3.0.8 Update rc2
Rubyonrails ≫ Rails Version 3.0.8 Update rc3
Rubyonrails ≫ Rails Version 3.0.8 Update rc4
Rubyonrails ≫ Ruby On Rails Version 3.0.4
Rubyonrails ≫ Rails Version 3.1.0
Rubyonrails ≫ Rails Version 3.1.0 Update beta1
Rubyonrails ≫ Rails Version 3.1.0 Update rc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.96% 0.777
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain
Patch
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
http://openwall.com/lists/oss-security/2011/06/09/2
Patch
http://openwall.com/lists/oss-security/2011/06/13/9
Patch
http://secunia.com/advisories/44789
Vendor Advisory
http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
Patch