Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-cwa7-9d2t-rfhb
Vulnerability ID VCID-cwa7-9d2t-rfhb
Aliases CVE-2012-3465
GHSA-7g65-ghrg-hpf5
OSV-84513
Summary actionpack Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/sanitize_helper.rb` in the `strip_tags` helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-0154.html
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2012-3465
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2012-3465
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2012-3465
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2012-3465
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2012-3465
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2012-3465
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2012-3465
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2012-3465
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-7g65-ghrg-hpf5
generic_textual MODERATE https://github.com/rails/rails
generic_textual MODERATE https://github.com/rails/rails/commit/cf48c9c7dcbef8543171f7f7de8d3d9a16b58e77
generic_textual MODERATE https://github.com/rails/rails/commit/e91e4e8bbee12ce1496bf384c04da6be296b687a
generic_textual MODERATE https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2012-3465
generic_textual MODERATE http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
Reference id Reference type URL
http://rhn.redhat.com/errata/RHSA-2013-0154.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3465.json
https://api.first.org/data/v1/epss?cve=CVE-2012-3465
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3465
https://github.com/rails/rails
https://github.com/rails/rails/commit/cf48c9c7dcbef8543171f7f7de8d3d9a16b58e77
https://github.com/rails/rails/commit/e91e4e8bbee12ce1496bf384c04da6be296b687a
https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain
http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released
847200 https://bugzilla.redhat.com/show_bug.cgi?id=847200
CVE-2012-3465 https://nvd.nist.gov/vuln/detail/CVE-2012-3465
GHSA-7g65-ghrg-hpf5 https://github.com/advisories/GHSA-7g65-ghrg-hpf5
RHSA-2012:1542 https://access.redhat.com/errata/RHSA-2012:1542
RHSA-2013:0154 https://access.redhat.com/errata/RHSA-2013:0154
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.56001
EPSS Score 0.00333
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:47:25.788858+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionpack/CVE-2012-3465.yml 38.0.0