CVE-2012-3464 — Cross-site Scripting in Ruby ON Rails

CWE-79 — Cross-site Scripting11 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 43.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Rubyonrails RailsRubyonrails Ruby ON Rails
Timeline
PublishedAug 10
Latest updateOct 24

Description

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶Debianrubyonrails/rails< 2.3.14.1+3
▶NVDrubyonrails/rails81 versions+80

🔴Vulnerability Details

4
GHSA
activesupport Cross-site Scripting vulnerability↗2017-10-24
▶
OSV
activesupport Cross-site Scripting vulnerability↗2017-10-24
▶
CVEList
CVE-2012-3464: Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety↗2012-08-10
▶
OSV
CVE-2012-3464: Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety↗2012-08-10
▶

📋Vendor Advisories

2
Red Hat
rubygem-actionpack: potential XSS vulnerability↗2012-08-09
▶
Debian
CVE-2012-3464: rails - Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/cor...↗2012
▶

💬Community

4
Bugzilla
CVE-2012-3463 CVE-2012-3464 CVE-2012-3465 rubygem-actionpack various flaws [fedora-all]↗2012-08-10
▶
Bugzilla
CVE-2012-3464 rubygem-actionpack: potential XSS vulnerability↗2012-08-10
▶
Bugzilla
CVE-2012-3463 CVE-2012-3464 CVE-2012-3465 CVE-2013-0156 rubygem-actionpack various flaws [epel-5]↗2012-08-10
▶
Bugzilla
CVE-2011-3464 libpng: One-byte stack buffer overrun in png_formatted_warning↗2012-07-25
▶
CVE-2012-3464 — Cross-site Scripting in Ruby ON Rails | cvebase