National Cyber Awareness System

Vulnerability Summary for CVE-2011-2931

Overview

Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a

Type: Patch Information

Hyperlink:https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=731436

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=731436

External Source: MLIST

Name: [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4)

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/22/5

External Source: MLIST

Name: [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4)

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/22/13

External Source: MLIST

Name: [oss-security] 20110820 Re: CVE request: ruby on rails flaws (4)

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/20/1

External Source: MLIST

Name: [oss-security] 20110819 Re: CVE request: ruby on rails flaws (4)

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/19/11

External Source: MLIST

Name: [oss-security] 20110817 CVE request: ruby on rails flaws (4)

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/17/1

External Source: CONFIRM

Name: http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6

Type: Patch Information

Hyperlink:http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6

External Source: MLIST

Name: [rubyonrails-security] 20110816 XSS Vulnerability in strip_tags helper

Type: Patch Information

Hyperlink:http://groups.google.com/group/rubyonrails-security/msg/fd41ab62966e0fd1?dmode=source&output=gplain

External Source: MLIST

Name: [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4)

Hyperlink:http://www.openwall.com/lists/oss-security/2011/08/22/14

External Source: DEBIAN

Name: DSA-2301

Hyperlink:http://www.debian.org/security/2011/dsa-2301

External Source: SECUNIA

Name: 45921

Hyperlink:http://secunia.com/advisories/45921

External Source: FEDORA

Name: FEDORA-2011-11386

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html

External Source: FEDORA

Name: FEDORA-2011-11567

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html

External Source: FEDORA

Name: FEDORA-2011-11572

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html