Fluid Attacks Database

Description

actionpack Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rubygems	actionpack	>=3.0.0.beta <3.0.17 \|\| >=3.1.0 <3.1.8 \|\| >=3.2.0 <3.2.8 \|\| >=0 <2.3.16	3.0.17, 3.1.8, 3.2.8, 2.3.16
debian 14	rails	>=0 <2.3.14.1	2.3.14.1
debian 13	rails	>=0 <2.3.14.1	2.3.14.1
debian 12	rails	>=0 <2.3.14.1	2.3.14.1

Aliases

1. CVE-2012-34652. NVD-2012-34653. OSV-2012-34654. OSV-DEBIAN-2012-34655. GCVE-2012-34656. SECURITY-TRACKER-CVE-2012-3465

References

1. https://github.com/rails/rails/commit/cf48c9c7dcbef8543171f7f7de8d3d9a16b58e772. https://github.com/rails/rails/commit/e91e4e8bbee12ce1496bf384c04da6be296b687a3. https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain4. http://rhn.redhat.com/errata/RHSA-2013-0154.html5. http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.