logo

Database

Reflected cross-site scripting (XSS) In actionpack

Description

actionpack Cross-site Scripting vulnerability The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-18552. NVD-2013-18553. OSV-2013-18554. OSV-DEBIAN-2013-18555. GCVE-2013-18556. access.redhat.com7. access.redhat.com8. ACCESS-CVE-2013-18559. SECURITY-TRACKER-CVE-2013-1855

References

1. https://bugzilla.redhat.com/show_bug.cgi?id=9213312. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-1855.yml3. https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain4. https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html5. https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html6. http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html7. http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html8. http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html9. http://rhn.redhat.com/errata/RHSA-2013-0698.html10. http://rhn.redhat.com/errata/RHSA-2014-1863.html11. http://support.apple.com/kb/HT578412. http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.