CVE-2011-2197: XSS
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2197?
CVE-2011-2197 is classified as a medium severity vulnerability that could allow remote attackers to conduct cross-site scripting (XSS) attacks.
How do I fix CVE-2011-2197?
To fix CVE-2011-2197, upgrade to Ruby on Rails versions 2.3.12, 3.0.8, or 3.1.0.rc2 or later.
What impact does CVE-2011-2197 have on my Ruby on Rails application?
CVE-2011-2197 allows attackers to bypass the XSS protection mechanism and potentially execute malicious scripts in the context of a user's session.
Which versions of Ruby on Rails are affected by CVE-2011-2197?
CVE-2011-2197 affects Ruby on Rails versions 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2.
Is CVE-2011-2197 a critical vulnerability?
CVE-2011-2197 is not classified as critical but poses significant security risks related to XSS attacks.