Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-v9v4-7jp6-8c73
Advisory ID github_osv/GHSA-v9v4-7jp6-8c73
Aliases CVE-2011-2197
Summary rails Cross-site Scripting vulnerability The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html
http://openwall.com/lists/oss-security/2011/06/09/2
http://openwall.com/lists/oss-security/2011/06/13/9
https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f
https://github.com/rails/rails
https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd
https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da
http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
CVE-2011-2197 https://nvd.nist.gov/vuln/detail/CVE-2011-2197
CVE-2011-2197.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.