Vulnerability advisory

GHSA-98mf-8f57-64qf

actionpack Cross-site Scripting vulnerability

Published Oct 24, 2017Updated Nov 30, 2024OSV record ↗

Also known as CVE-2012-3463

Severity

Severity not reported.

Affected versions

actionpack RubyGems

All actionpack advisories →

Affected	Fixed in
`3.0` to before 3.0.17	`3.0.17`Advisories →
Also listed as affected (33) `3.0.0` `3.0.1` `3.0.10` `3.0.10.rc1` `3.0.11` `3.0.12` `3.0.12.rc1` `3.0.13` `3.0.13.rc1` `3.0.14` `3.0.15` `3.0.16` `3.0.2` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5`
`3.1.0` to before 3.1.8	`3.1.8`Advisories →
Also listed as affected (15) `3.1.0` `3.1.1` `3.1.1.rc1` `3.1.1.rc2` `3.1.1.rc3` `3.1.2` `3.1.2.rc1` `3.1.2.rc2` `3.1.3` `3.1.4` `3.1.4.rc1` `3.1.5` `3.1.5.rc1` `3.1.6` `3.1.7`
`3.2.0` to before 3.2.8	`3.2.8`Advisories →
Also listed as affected (15) `3.2.0` `3.2.1` `3.2.2` `3.2.2.rc1` `3.2.3` `3.2.3.rc1` `3.2.3.rc2` `3.2.4` `3.2.4.rc1` `3.2.5` `3.2.6` `3.2.7` `3.2.7.rc1` `3.2.8.rc1` `3.2.8.rc2`

Description

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.

GHSA-98mf-8f57-64qf

Affected versions

actionpack RubyGems

Description

References