activesupport Cross-site Scripting vulnerability
Moderate severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Nov 10, 2023
Package
Affected versions
>= 4.1.0, < 4.1.11
>= 4.2.0, < 4.2.2
>= 3.0.0, <= 3.2.22.4
Patched versions
4.1.11
4.2.2
3.2.22.5
Description
Published by the National Vulnerability Database
Jul 26, 2015
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Nov 10, 2023
Cross-site scripting (XSS) vulnerability in
json/encoding.rbin Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.References