CVE-2009-3009: XSS
Published Sep 8, 2009
·Updated
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.
Affected Software
18 affected componentsFixes available
rubygems/activesupport>=2.3.0<2.3.4
2.3.4
rubygems/activesupport>=2.0.0<2.2.3
2.2.3
rubygems/actionpack>=2.3.0<2.3.4
2.3.4
rubygems/actionpack>=2.0.0<2.2.3
2.2.3
rubyonrails Rails=2.0.1
rubyonrails Rails=2.0.2
rubyonrails Rails=2.0.4
rubyonrails Rails=2.1.0
rubyonrails Rails=2.1.1
rubyonrails Rails=2.1.2
rubyonrails Rails=2.2.0
rubyonrails Rails=2.2.1
rubyonrails Rails=2.2.2
rubyonrails Rails=2.3.2
rubyonrails Rails=2.3.3
rubyonrails Rails=2.0.0-rc1
rubyonrails Rails=2.0.0-rc2
rubyonrails Rails=2.0.0
Remediation
Patch Available
Patch Available
Event History
Sep 8, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Oct 24, 2017
Advisory Published
06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2009-3009?
CVE-2009-3009 is classified as a high-severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2009-3009?
To fix CVE-2009-3009, upgrade Ruby on Rails to version 2.2.3 or later, or version 2.3.4 or later.
3
Which Ruby on Rails versions are affected by CVE-2009-3009?
CVE-2009-3009 affects Ruby on Rails versions 2.x before 2.2.3 and 2.3.x before 2.3.4.
4
What type of vulnerability is CVE-2009-3009?
CVE-2009-3009 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts.
5
Can CVE-2009-3009 be exploited remotely?
Yes, CVE-2009-3009 can be exploited remotely by injecting malformed Unicode strings into form helpers.