CVE-2009-3009

EPSS 3.0%

Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://secunia.com/advisories/36600 http://secunia.com/advisories/36717 http://securitytracker.com/id?1022824 https://exchange.xforce.ibmcloud.com/vulnerabilities/53036 http://support.apple.com/kb/HT4077 http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails http://www.debian.org/security/2009/dsa-1887 http://www.osvdb.org/57666