CVE-2012-1098 rubygem-activesupport: XSS in SafeBuffer#[] (unescaped safe buffers can be marked as safe)
Published: March 01, 2012
SECURITY IDENTIFIERS
- CVE: CVE-2012-1098 (NVD)
- GHSA: GHSA-qv8p-v9qw-wc7g
- OSVDB: OSVDB-79726
GEM
FRAMEWORK
SEVERITY
CVSS v2.0: 4.3 (Medium)
UNAFFECTED VERSIONS
< 3.0.0
PATCHED VERSIONS
~> 3.0.12
~> 3.1.4
>= 3.2.2
DESCRIPTION
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.