Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2007-3227

Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.

Published

2007-06-14T23:30:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	rubyonrails	rails	1.1.5	Yes

References

http://bugs.gentoo.org/show_bug.cgi?id=195315 ([email protected])
http://dev.rubyonrails.org/ticket/8371 ([email protected])
http://osvdb.org/36378 ([email protected])
http://pastie.caboo.se/65550.txt ([email protected])
http://secunia.com/advisories/25699 Vendor Advisory ([email protected])
http://secunia.com/advisories/27657 Vendor Advisory ([email protected])
http://secunia.com/advisories/27756 Vendor Advisory ([email protected])
http://security.gentoo.org/glsa/glsa-200711-17.xml ([email protected])
http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release ([email protected])
http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release ([email protected])
http://www.novell.com/linux/security/advisories/2007_24_sr.html ([email protected])
http://www.securityfocus.com/bid/24161 Exploit ([email protected])
http://www.vupen.com/english/advisories/2007/2216 Vendor Advisory ([email protected])
http://bugs.gentoo.org/show_bug.cgi?id=195315 (af854a3a-2127-422b-91ae-364da2661108)
http://dev.rubyonrails.org/ticket/8371 (af854a3a-2127-422b-91ae-364da2661108)
http://osvdb.org/36378 (af854a3a-2127-422b-91ae-364da2661108)
http://pastie.caboo.se/65550.txt (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25699 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/27657 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/27756 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200711-17.xml (af854a3a-2127-422b-91ae-364da2661108)
http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release (af854a3a-2127-422b-91ae-364da2661108)
http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release (af854a3a-2127-422b-91ae-364da2661108)
http://www.novell.com/linux/security/advisories/2007_24_sr.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/24161 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/2216 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)