Vulnerability Description
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rubyonrails | Rails | 3.0.0 |
| Rubyonrails | Ruby On Rails | 3.0.4 |
Related Weaknesses (CWE)
References
- http://groups.google.com/group/rubyonrails-security/msg/1c2e01a5e42722c9?dmode=s
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html
- http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
- http://www.openwall.com/lists/oss-security/2012/03/02/6
- http://www.openwall.com/lists/oss-security/2012/03/03/1
- https://bugzilla.redhat.com/show_bug.cgi?id=799275
- http://groups.google.com/group/rubyonrails-security/msg/1c2e01a5e42722c9?dmode=s
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html
- http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
- http://www.openwall.com/lists/oss-security/2012/03/02/6
- http://www.openwall.com/lists/oss-security/2012/03/03/1
- https://bugzilla.redhat.com/show_bug.cgi?id=799275
FAQ
What is CVE-2012-1098?
CVE-2012-1098 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors inv...
How severe is CVE-2012-1098?
CVE-2012-1098 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-1098?
Check the references section above for vendor advisories and patch information. Affected products include: Rubyonrails Rails, Rubyonrails Ruby On Rails.