CVE-2009-4214

Опубликовано: 07 дек. 2009

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*

Версия до 2.1.2 (включая)

cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 81%

0.01632

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2009-4214

ubuntu

около 16 лет назад

CVE-2009-4214

redhat

около 16 лет назад

CVE-2009-4214

debian

около 16 лет назад

Cross-site scripting (XSS) vulnerability in the strip_tags function in ...

GHSA-9p3v-wf2w-v29c

github

около 8 лет назад

Moderate severity vulnerability that affects rails

EPSS

Процентиль: 81%

0.01632

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79