CVE-2009-3009

Publicada el 08 sep 2009 · Actualizada el 07 ago 2024

Seguir esta CVE + Monitorear rails + Monitorear actionpack

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 3.0%

Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

Productos afectados

n/a · n/a

Referencias

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://secunia.com/advisories/36600 http://secunia.com/advisories/36717 http://securitytracker.com/id?1022824 https://exchange.xforce.ibmcloud.com/vulnerabilities/53036 http://support.apple.com/kb/HT4077 http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails http://www.debian.org/security/2009/dsa-1887 http://www.osvdb.org/57666