CVE-2011-2197
- State
- Published
- Severity
- Not scored
- Published
- Jun 30, 2011
- Updated
- Aug 6, 2024
- Reserved
- May 31, 2011
Description
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [rubyonrails-security] 20110607 Potential XSS Vulnerability in Ruby on Rails Applicationsmailing-list
- FEDORA-2011-8494vendor-advisory
- FEDORA-2011-8580vendor-advisory
- http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications
- 44789third-party-advisory
- [oss-security] 20110609 CVE Request: Ruby on Rails 3/rails_xss XSSmailing-list
- [oss-security] 20110613 Re: CVE Request: Ruby on Rails 3/rails_xss XSSmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.