CVE-2015-3226

Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://openwall.com/lists/oss-security/2015/06/16/17
http://www.debian.org/security/2016/dsa-3464
http://www.securityfocus.com/bid/75231
http://www.securitytracker.com/id/1033755
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ	Vendor Advisory
http://openwall.com/lists/oss-security/2015/06/16/17
http://www.debian.org/security/2016/dsa-3464
http://www.securityfocus.com/bid/75231
http://www.securitytracker.com/id/1033755
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rubyonrails:rails:3.0.0:::::::*
	cpe:2.3:a:rubyonrails:rails:3.1.0:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.0:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.1:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.2:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.3:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.4:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.5:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.6:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.7:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.8:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.9:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.10:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.11:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.12:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.13:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.15:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.16:::::::*
	cpe:2.3:a:rubyonrails:rails:3.2.17:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.0:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.1:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.2:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.3:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.4:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.5:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.6:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.7:::::::*
	cpe:2.3:a:rubyonrails:rails:4.1.8:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.0:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.1:::::::*
	cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:::::::*

History

21 Nov 2024, 02:28

Type	Values Removed	Values Added
References	~~() http://openwall.com/lists/oss-security/2015/06/16/17 -~~	() http://openwall.com/lists/oss-security/2015/06/16/17 -
References	~~() http://www.debian.org/security/2016/dsa-3464 -~~	() http://www.debian.org/security/2016/dsa-3464 -
References	~~() http://www.securityfocus.com/bid/75231 -~~	() http://www.securityfocus.com/bid/75231 -
References	~~() http://www.securitytracker.com/id/1033755 -~~	() http://www.securitytracker.com/id/1033755 -
References	~~() https://groups.google.com/forum/message/raw?msg=rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ - Vendor Advisory~~	() https://groups.google.com/forum/message/raw?msg=rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ - Vendor Advisory

Information

Published : 2015-07-26 22:59

Updated : 2024-11-21 02:28

NVD link : CVE-2015-3226

Mitre link : CVE-2015-3226

CVE.ORG link : CVE-2015-3226

JSON object : View

Products Affected

rubyonrails

rails
ruby_on_rails

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

4.3 /10