CVE-2017-12097
- State
- Published
- Severity
- 6.1 Medium
- Published
- Jan 19, 2018
- Updated
- Sep 16, 2024
- Reserved
- Jul 31, 2017
Description
An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.1 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | talos |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
delayed_job_web rails gemTalos |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.