Vulnerability advisory

GHSA-7g65-ghrg-hpf5

actionpack Cross-site Scripting vulnerability

Published Oct 24, 2017Updated Jan 21, 2025OSV record ↗

Also known as CVE-2012-3465

Severity

Severity not reported.

Affected versions

actionpack RubyGems

All actionpack advisories →

Affected	Fixed in
`3.0.0.beta` to before 3.0.17	`3.0.17`Advisories →
Also listed as affected (39) `3.0.0` `3.0.0.beta` `3.0.0.beta2` `3.0.0.beta3` `3.0.0.beta4` `3.0.0.rc` `3.0.0.rc2` `3.0.1` `3.0.10` `3.0.10.rc1` `3.0.11` `3.0.12` `3.0.12.rc1` `3.0.13` `3.0.13.rc1` `3.0.14` `3.0.15` `3.0.16` `3.0.2` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5`
`3.1.0` to before 3.1.8	`3.1.8`Advisories →
Also listed as affected (15) `3.1.0` `3.1.1` `3.1.1.rc1` `3.1.1.rc2` `3.1.1.rc3` `3.1.2` `3.1.2.rc1` `3.1.2.rc2` `3.1.3` `3.1.4` `3.1.4.rc1` `3.1.5` `3.1.5.rc1` `3.1.6` `3.1.7`
`3.2.0` to before 3.2.8	`3.2.8`Advisories →
Also listed as affected (15) `3.2.0` `3.2.1` `3.2.2` `3.2.2.rc1` `3.2.3` `3.2.3.rc1` `3.2.3.rc2` `3.2.4` `3.2.4.rc1` `3.2.5` `3.2.6` `3.2.7` `3.2.7.rc1` `3.2.8.rc1` `3.2.8.rc2`
All versions before 2.3.16	`2.3.16`Advisories →
Also listed as affected (60) `0.9.0` `0.9.5` `1.0.0` `1.0.1` `1.1.0` `1.10.1` `1.10.2` `1.11.0` `1.11.1` `1.11.2` `1.12.0` `1.12.1` `1.12.2` `1.12.3` `1.12.4` `1.12.5` `1.13.0` `1.13.1` `1.13.2` `1.13.3` `1.13.4` `1.13.5` `1.13.6` `1.2.0` `1.3.0` `1.3.1` `1.4.0` `1.5.0` `1.5.1` `1.6.0` `1.7.0` `1.8.0` `1.8.1` `1.9.0` `1.9.1` `2.0.0` `2.0.1` `2.0.2` `2.0.4` `2.0.5` `2.1.0` `2.1.1` `2.1.2` `2.2.2` `2.2.3` `2.3.10` `2.3.11` `2.3.12` `2.3.14` `2.3.15` `2.3.2` `2.3.3` `2.3.4` `2.3.5` `2.3.6` `2.3.7` `2.3.8` `2.3.8.pre1` `2.3.9` `2.3.9.pre`

Description

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

GHSA-7g65-ghrg-hpf5

Affected versions

actionpack RubyGems

Description

References