Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-xxr8-833v-c7wc
Advisory ID github_osv/GHSA-xxr8-833v-c7wc
Aliases CVE-2011-4319
Summary Cross-site Scripting vulnerability in i18n translations helper method Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1
http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain
http://openwall.com/lists/oss-security/2011/11/18/8
https://exchange.xforce.ibmcloud.com/vulnerabilities/71364
https://github.com/rails/rails
https://github.com/rails/rails/commit/2d5b105d4bcb652550dda8b5613376d1b8beb70c
https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-4319.yml
https://groups.google.com/forum/#!topic/rubyonrails-security/K2HXD7c8fMU
https://web.archive.org/web/20200228155840/http://www.securityfocus.com/bid/50722
https://web.archive.org/web/20210307005941/http://www.securitytracker.com/id?1026342
http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released
CVE-2011-4319 https://nvd.nist.gov/vuln/detail/CVE-2011-4319

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.