CVE-2015-7580

Опубликовано: 16 фев. 2016

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:rubyonrails:html_sanitizer:*:*:*:*:*:ruby:*:*

Версия до 1.0.2 (включая)

Одно из

cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*

EPSS

Процентиль: 38%

0.00163

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2015-7580

CVSS3: 6.1

ubuntu

почти 10 лет назад

CVE-2015-7580

CVSS3: 6.1

debian

почти 10 лет назад

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.r ...

GHSA-ghqm-pgxj-37gq

CVSS3: 6.1

github

больше 8 лет назад

rails-html-sanitizer Cross-site Scripting vulnerability

openSUSE-SU-2016:0356-1

suse-cvrf

около 10 лет назад

Security update for rubygem-rails-html-sanitizer

SUSE-SU-2016:1146-1

suse-cvrf

почти 10 лет назад

Security update for portus

EPSS

Процентиль: 38%

0.00163

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79