Vulnerability advisory

GHSA-75w6-p6mg-vh8j

Rails actionpack gem vulnerable to Cross-site Scripting

Published Oct 24, 2017Updated Nov 28, 2024OSV record ↗

Also known as CVE-2011-0446

Severity

Severity not reported.

Affected versions

actionpack RubyGems

All actionpack advisories →

Affected	Fixed in
All versions before 2.3.11	`2.3.11`Advisories →
Also listed as affected (56) `0.9.0` `0.9.5` `1.0.0` `1.0.1` `1.1.0` `1.10.1` `1.10.2` `1.11.0` `1.11.1` `1.11.2` `1.12.0` `1.12.1` `1.12.2` `1.12.3` `1.12.4` `1.12.5` `1.13.0` `1.13.1` `1.13.2` `1.13.3` `1.13.4` `1.13.5` `1.13.6` `1.2.0` `1.3.0` `1.3.1` `1.4.0` `1.5.0` `1.5.1` `1.6.0` `1.7.0` `1.8.0` `1.8.1` `1.9.0` `1.9.1` `2.0.0` `2.0.1` `2.0.2` `2.0.4` `2.0.5` `2.1.0` `2.1.1` `2.1.2` `2.2.2` `2.2.3` `2.3.10` `2.3.2` `2.3.3` `2.3.4` `2.3.5` `2.3.6` `2.3.7` `2.3.8` `2.3.8.pre1` `2.3.9` `2.3.9.pre`
`3.0.0` to before 3.0.4	`3.0.4`Advisories →
Also listed as affected (5) `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.0.4.rc1`

actionview RubyGems

All actionview advisories →

Affected	Fixed in
All versions before 2.3.11	`2.3.11`Advisories →
`3.0.0` to before 3.0.4	`3.0.4`Advisories →

Description

Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.

GHSA-75w6-p6mg-vh8j

Affected versions

actionpack RubyGems

actionview RubyGems

Description

References