Vulnerabilidad en Roby en Rails (CVE-2009-3009)
Gravedad CVSS v2.0:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
08/09/2009
Última modificación:
09/04/2025
Descripción
Vulnerabilidad de ejecución secuencias de comandos en sitios cruzados (XSS) en Roby en Rails v2.x anterior 2.2.3, y v2.3.x anterior v2.3.4, permite a atacantes remotos inyectar código web o HTML a su elección colocando cadenas malformadas Unicode en un formulario de ayuda.
Impacto
Puntuación base 2.0
4.30
Gravedad 2.0
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
- http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- http://secunia.com/advisories/36600
- http://secunia.com/advisories/36717
- http://securitytracker.com/id?1022824=
- http://support.apple.com/kb/HT4077
- http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails
- http://www.debian.org/security/2009/dsa-1887
- http://www.osvdb.org/57666
- http://www.securityfocus.com/bid/36278
- http://www.vupen.com/english/advisories/2009/2544
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53036
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063
- http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- http://secunia.com/advisories/36600
- http://secunia.com/advisories/36717
- http://securitytracker.com/id?1022824=
- http://support.apple.com/kb/HT4077
- http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails
- http://www.debian.org/security/2009/dsa-1887
- http://www.osvdb.org/57666
- http://www.securityfocus.com/bid/36278
- http://www.vupen.com/english/advisories/2009/2544
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53036