GHSA-8qrh-h9m2-5fvf
Cross site scripting that affects rails
At a glance
- Published
- Updated
- CVE
- CVE-2009-3009
Description
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.
Affected packages
| Package | Versions |
|---|---|
| RubyGems · actionpack | introduced 2.0.0, fixed 2.2.3 |
| RubyGems · actionpack | introduced 2.3.0, fixed 2.3.4 |
| RubyGems · activesupport | introduced 2.0.0, fixed 2.2.3 |
| RubyGems · activesupport | introduced 2.3.0, fixed 2.3.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2009-3009 ADVISORY
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53036 WEB
- https://github.com/advisories/GHSA-8qrh-h9m2-5fvf ADVISORY
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2009-3009.yml WEB
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 WEB
- http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source WEB
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html WEB
- http://secunia.com/advisories/36600 WEB
- http://secunia.com/advisories/36717 WEB
- http://securitytracker.com/id?1022824 WEB
- http://support.apple.com/kb/HT4077 WEB
- http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails WEB
- http://www.debian.org/security/2009/dsa-1887 WEB
- http://www.osvdb.org/57666 WEB
- http://www.securityfocus.com/bid/36278 WEB
- http://www.vupen.com/english/advisories/2009/2544 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |