CVE-2011-1497 Cross site scripting in actionpack Rubygem
MediumCVSS 6.1
EPSS 1.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | >= 3.0.0.rc, < 3.0.6 | 3.0.6 |
| rubygems actionpack(RubyGems) | = 3.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.rc | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6.rc2 | No fix listed |
| rubyonrails rails | < 3.0.6 | 3.0.6 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com product
- github.com release-notes third-party-advisory
- github.com exploit
- www.openwall.com exploit mailing-list third-party-advisory
- github.com
- Debian Security Tracker CVE-2011-1497 vendor-advisory