Published: 16/02/2016 Updated: 08/08/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem prior to 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote malicious users to inject arbitrary web script or HTML via a crafted CDATA node.

Vulnerable Product	Search on Vulmon	Subscribe to Product
rubyonrails html_sanitizer

Debian Bug report logs - #812814 CVE-2015-7578 CVE-2015-7579 CVE-2015-7580 Package: ruby-rails-html-sanitizer; Maintainer for ruby-rails-html-sanitizer is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Source for ruby-rails-html-sanitizer is src:ruby-rails-html-sanitizer (PTS, buildd, popcon) ...

CWE-79 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ http://www.openwall.com/lists/oss-security/2016/01/25/15 https://github.com/rails/rails-html-sanitizer/commit/63903b0eaa6d2a4e1c91bc86008256c4c8335e78 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00024.html http://www.securitytracker.com/id/1034816 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812814 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-7580

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect