Vulnerability advisory

GHSA-2xjj-5x6h-8vmf

Cross-site Scripting in actionpack

Published Oct 24, 2017Updated Nov 29, 2024OSV record ↗

Also known as CVE-2012-1099

Severity

Severity not reported.

Affected versions

actionpack RubyGems

All actionpack advisories →

Affected	Fixed in
`3.0.0` to before 3.0.12	`3.0.12`Advisories →
Also listed as affected (27) `3.0.0` `3.0.1` `3.0.10` `3.0.10.rc1` `3.0.11` `3.0.12.rc1` `3.0.2` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5`
`3.1.0` to before 3.1.4	`3.1.4`Advisories →
Also listed as affected (10) `3.1.0` `3.1.1` `3.1.1.rc1` `3.1.1.rc2` `3.1.1.rc3` `3.1.2` `3.1.2.rc1` `3.1.2.rc2` `3.1.3` `3.1.4.rc1`
`3.2.0` to before 3.2.2	`3.2.2`Advisories →
Also listed as affected (3) `3.2.0` `3.2.1` `3.2.2.rc1`

Description

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.

GHSA-2xjj-5x6h-8vmf

Affected versions

actionpack RubyGems

Description

References