Vulnerability advisory

GHSA-9fh3-vh3h-q4g3

activesupport Cross-site Scripting vulnerability

Published Oct 24, 2017Updated Nov 29, 2024OSV record ↗

Also known as CVE-2011-2932

Severity

Severity not reported.

Affected versions

activesupport RubyGems

All activesupport advisories →

Affected	Fixed in
`2.0.0` to before 2.3.13	`2.3.13`Advisories →
Also listed as affected (24) `2.0.0` `2.0.1` `2.0.2` `2.0.4` `2.0.5` `2.1.0` `2.1.1` `2.1.2` `2.2.2` `2.2.3` `2.3.10` `2.3.11` `2.3.12` `2.3.2` `2.3.3` `2.3.4` `2.3.5` `2.3.6` `2.3.6.pre` `2.3.7` `2.3.8` `2.3.8.pre1` `2.3.9` `2.3.9.pre`
`3.0.0` to before 3.0.10	`3.0.10`Advisories →
Also listed as affected (24) `3.0.0` `3.0.1` `3.0.10.rc1` `3.0.2` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5`

Description

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."

GHSA-9fh3-vh3h-q4g3

Affected versions

activesupport RubyGems

Description

References