GHSA-75w6-p6mg-vh8j

Source
https://github.com/advisories/GHSA-75w6-p6mg-vh8j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-75w6-p6mg-vh8j/GHSA-75w6-p6mg-vh8j.json
Aliases
  • CVE-2011-0446
Published
2017-10-24T18:33:38Z
Modified
2024-02-16T08:23:35.526863Z
Details

Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.

References

Affected packages

RubyGems / actionpack

Package

Name
actionpack

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
2.3.11

Affected versions

0.*

0.9.0
0.9.5

1.*

1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.10.1
1.10.2
1.11.0
1.11.1
1.11.2
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6

2.*

2.0.0
2.0.1
2.0.2
2.0.4
2.0.5
2.1.0
2.1.1
2.1.2
2.2.2
2.2.3
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8.pre1
2.3.8
2.3.9.pre
2.3.9
2.3.10

RubyGems / actionpack

Package

Name
actionpack

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.0.4

Affected versions

3.*

3.0.0
3.0.1
3.0.2
3.0.3
3.0.4.rc1

RubyGems / actionview

Package

Name
actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
2.3.11

RubyGems / actionview

Package

Name
actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.0.4