GHSA-2xjj-5x6h-8vmf
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2xjj-5x6h-8vmf
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-2xjj-5x6h-8vmf/GHSA-2xjj-5x6h-8vmf.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2xjj-5x6h-8vmf
- Aliases
- Published
- 2017-10-24T18:33:38Z
- Modified
- 2024-11-29T05:40:31.205427Z
- Summary
- Cross-site Scripting in actionpack
- Details
-
Cross-site scripting (XSS) vulnerability in
actionpack/lib/action_view/helpers/form_options_helper.rbin the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements. - Database specific
{ "nvd_published_at": "2012-03-13T10:55:01Z", "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:53:21Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2012-1099
- https://bugzilla.redhat.com/show_bug.cgi?id=799276
- https://github.com/advisories/GHSA-2xjj-5x6h-8vmf
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-1099.yml
- http://groups.google.com/group/rubyonrails-security/msg/6fca4f5c47705488?dmode=source&output=gplain
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075740.html
- http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
- http://www.debian.org/security/2012/dsa-2466
- http://www.openwall.com/lists/oss-security/2012/03/02/6
- http://www.openwall.com/lists/oss-security/2012/03/03/1
Affected packages
RubyGems / actionpack
Package
- Name
- actionpack
- Purl
- pkg:gem/actionpack
RubyGems / actionpack
Package
- Name
- actionpack
- Purl
- pkg:gem/actionpack
RubyGems / actionpack
Package
- Name
- actionpack
- Purl
- pkg:gem/actionpack