Vulnerability advisory

GHSA-qv8p-v9qw-wc7g

activesupport Cross-site Scripting vulnerability

Published Oct 24, 2017Updated Nov 30, 2024OSV record ↗

Also known as CVE-2012-1098

Severity

Severity not reported.

Affected versions

activesupport RubyGems

All activesupport advisories →

Affected	Fixed in
`3.0.0` to before 3.0.12	`3.0.12`Advisories →
Also listed as affected (27) `3.0.0` `3.0.1` `3.0.10` `3.0.10.rc1` `3.0.11` `3.0.12.rc1` `3.0.2` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5`
`3.1.0` to before 3.1.4	`3.1.4`Advisories →
Also listed as affected (10) `3.1.0` `3.1.1` `3.1.1.rc1` `3.1.1.rc2` `3.1.1.rc3` `3.1.2` `3.1.2.rc1` `3.1.2.rc2` `3.1.3` `3.1.4.rc1`
`3.2.0` to before 3.2.2	`3.2.2`Advisories →
Also listed as affected (3) `3.2.0` `3.2.1` `3.2.2.rc1`

Description

Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.

GHSA-qv8p-v9qw-wc7g

Affected versions

activesupport RubyGems

Description

References