CVE-2010-1330: XSS
A cross-site scripting (XSS) flaw was found in the way the regular expression engine of the JRuby, Java implementation of the Ruby programming language, processed certain invalid UTF-8 byte sequences. A remote attacker could use this flaw to execute arbitrary HTML or web script via specially-crafted input provided to an JRuby application.
References: [1] http://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html [2] https://bugs.gentoo.org/showbug.cgi?id=317435
Proposed upstream solution (is to upgrage to jcodings-v1.0.3): [3] http://repo1.maven.org/maven2/org/jruby/jcodings/jcodings/1.0.3/jcodings-1.0.3.jar
Other sources
The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1330?
The severity of CVE-2010-1330 is classified as medium due to its potential for cross-site scripting attacks.
How do I fix CVE-2010-1330?
To fix CVE-2010-1330, upgrade JRuby to version 1.4.1 or later, which addresses the vulnerability.
Which versions of JRuby are affected by CVE-2010-1330?
CVE-2010-1330 affects multiple JRuby versions including 0.9.0 through 1.4.0-rc3.
What kind of attacks can exploit CVE-2010-1330?
CVE-2010-1330 can be exploited for cross-site scripting attacks, allowing remote attackers to execute arbitrary HTML or web scripts.
Is there a known exploit for CVE-2010-1330?
As of now, there are no publicly disclosed exploits specifically targeting CVE-2010-1330.