icon

We found results for “

WS-2012-0023

Good to know:

icon

Date: September 8, 2012

XSS injection vulnerability was found in loofah before 0.4.6. Loofah Gem for Ruby contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the Loofah::HTML::Document\#text function passes properly sanitized user-supplied input to the Loofah::XssFoliate and Loofah::Helpers\#strip_tags functions which convert input back to text. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Language: Ruby

Severity Score

Severity Score

Weakness Type (CWE)

Code

CWE-17

Cross-Site Scripting (XSS)

CWE-79

Injection

CWE-74

Top Fix

icon

Upgrade Version

Upgrade to version loofah - 0.4.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privilegs Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us