CVE-2012-3465

UNKNOWN

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper

Published Aug 10, 2012

Modified 1 years ago

Details

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

References

ADVISORY

http://rhn.redhat.com/errata/RHSA-2013-0154.html

ADVISORY

http://secunia.com/advisories/50694

WEB

http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/

WEB

https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2012-3465

CVSS Analysis