Vulnerability advisory

GHSA-v5jg-558j-q67c

actionpack Cross-site Scripting vulnerability

Published Oct 24, 2017Updated Nov 29, 2024OSV record ↗

Also known as CVE-2011-2931

Severity

Severity not reported.

Affected versions

actionpack RubyGems

All actionpack advisories →

Affected	Fixed in
`2.0.0` to before 2.3.13	`2.3.13`Advisories →
Also listed as affected (23) `2.0.0` `2.0.1` `2.0.2` `2.0.4` `2.0.5` `2.1.0` `2.1.1` `2.1.2` `2.2.2` `2.2.3` `2.3.10` `2.3.11` `2.3.12` `2.3.2` `2.3.3` `2.3.4` `2.3.5` `2.3.6` `2.3.7` `2.3.8` `2.3.8.pre1` `2.3.9` `2.3.9.pre`
`3.0.0` to before 3.0.10	`3.0.10`Advisories →
Also listed as affected (24) `3.0.0` `3.0.1` `3.0.10.rc1` `3.0.2` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5`

Description

Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.

GHSA-v5jg-558j-q67c

Affected versions

actionpack RubyGems

Description

References