Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-2932

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."

Published

2011-08-29T18:55:01.567

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	rubyonrails	rails	2.0.0	Yes
Application	rubyonrails	rails	2.0.0	Yes
Application	rubyonrails	rails	2.0.0	Yes
Application	rubyonrails	rails	2.0.1	Yes
Application	rubyonrails	rails	2.0.2	Yes
Application	rubyonrails	rails	2.0.4	Yes
Application	rubyonrails	rails	2.1.0	Yes
Application	rubyonrails	rails	2.1.1	Yes
Application	rubyonrails	rails	2.1.2	Yes
Application	rubyonrails	rails	2.2.0	Yes
Application	rubyonrails	rails	2.2.1	Yes
Application	rubyonrails	rails	2.2.2	Yes
Application	rubyonrails	rails	2.3.2	Yes
Application	rubyonrails	rails	2.3.3	Yes
Application	rubyonrails	rails	2.3.4	Yes
Application	rubyonrails	rails	2.3.9	Yes
Application	rubyonrails	rails	2.3.10	Yes
Application	rubyonrails	rails	2.3.11	Yes
Application	rubyonrails	rails	2.3.12	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.1	Yes
Application	rubyonrails	rails	3.0.1	Yes
Application	rubyonrails	rails	3.0.2	Yes
Application	rubyonrails	rails	3.0.2	Yes
Application	rubyonrails	rails	3.0.3	Yes
Application	rubyonrails	rails	3.0.4	Yes
Application	rubyonrails	rails	3.0.5	Yes
Application	rubyonrails	rails	3.0.5	Yes
Application	rubyonrails	rails	3.0.6	Yes
Application	rubyonrails	rails	3.0.6	Yes
Application	rubyonrails	rails	3.0.6	Yes
Application	rubyonrails	rails	3.0.7	Yes
Application	rubyonrails	rails	3.0.7	Yes
Application	rubyonrails	rails	3.0.7	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.10	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	ruby_on_rails	3.0.4	Yes

References

http://groups.google.com/group/rubyonrails-security/msg/f1d2749773db9f21?dmode=source&output=gplain Patch ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065114.html ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065189.html ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html ([email protected])
http://secunia.com/advisories/45917 ([email protected])
http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 Patch ([email protected])
http://www.openwall.com/lists/oss-security/2011/08/17/1 Patch ([email protected])
http://www.openwall.com/lists/oss-security/2011/08/19/11 Patch ([email protected])
http://www.openwall.com/lists/oss-security/2011/08/20/1 Patch ([email protected])
http://www.openwall.com/lists/oss-security/2011/08/22/13 Patch ([email protected])
http://www.openwall.com/lists/oss-security/2011/08/22/14 ([email protected])
http://www.openwall.com/lists/oss-security/2011/08/22/5 Patch ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=731435 Patch ([email protected])
https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd Patch ([email protected])
http://groups.google.com/group/rubyonrails-security/msg/f1d2749773db9f21?dmode=source&output=gplain Patch (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065114.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065189.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/45917 (af854a3a-2127-422b-91ae-364da2661108)
http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/08/17/1 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/08/19/11 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/08/20/1 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/08/22/13 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/08/22/14 (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2011/08/22/5 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=731435 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd Patch (af854a3a-2127-422b-91ae-364da2661108)