Advisory details:
ruby_advisory_db / gems/actionpack/CVE-2011-2197
| Advisory ID | ruby_advisory_db/gems/actionpack/CVE-2011-2197 |
| Aliases |
CVE-2011-2197
GHSA-v9v4-7jp6-8c73 |
| Summary | Potential XSS Vulnerability in Ruby on Rails Applications The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv2 | 4.3 |
| Reference id | Reference type | URL |
|---|---|---|
| http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications |
No exploits are available.
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no known vectors.
There are no SSVC decisions available.