medium
4.3
CWE
79
Advisory Published
CVE Published
Advisory Published
Updated

CVE-2012-1099: XSS

First published: Fri Mar 02 2012(Updated: )

A cross-site scripting (XSS) flaw was found in the way 'select' helper method of the Ruby on Rails performed HTML escaping of 'select' HTML tag options, when the tags were created manually. In this case, the select tag values might end up unescaped. A remote-attacker could provide a specially-crafted input to Ruby on Rails application, using select tags this way, which potentially resulted into arbitrary HTML or webscript execution. References: [1] <a href="http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released">http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released</a> [2] <a href="http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9da0c515a6c4664">http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9da0c515a6c4664</a> [3] <a href="https://bugs.gentoo.org/show_bug.cgi?id=406547">https://bugs.gentoo.org/show_bug.cgi?id=406547</a> Proposed upstream patches: [4] <a href="http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-0-select_options.patch?part=3">http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-0-select_options.patch?part=3</a> (against v3.0 branch) [5] <a href="http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-1-select_options.patch?part=4">http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-1-select_options.patch?part=4</a> (against v3.1 branch) [6] <a href="http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-2-select_options.patch?part=5">http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-2-select_options.patch?part=5</a> (against v3.2 branch)

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
rubygems/actionpack>=3.2.0<3.2.2
3.2.2
rubygems/actionpack>=3.1.0<3.1.4
3.1.4
rubygems/actionpack>=3.0.0<3.0.12
3.0.12
redhat/rubygem-actionpack<3.0.12
3.0.12
redhat/rubygem-actionpack<3.1.4
3.1.4
redhat/rubygem-actionpack<3.2.2
3.2.2
Ruby on Rails=3.0.0
Ruby on Rails=3.0.0-beta
Ruby on Rails=3.0.0-beta2
Ruby on Rails=3.0.0-beta3
Ruby on Rails=3.0.0-beta4
Ruby on Rails=3.0.0-rc
Ruby on Rails=3.0.0-rc2
Ruby on Rails=3.0.1
Ruby on Rails=3.0.1-pre
Ruby on Rails=3.0.2
Ruby on Rails=3.0.2-pre
Ruby on Rails=3.0.3
Ruby on Rails=3.0.4-rc1
Ruby on Rails=3.0.5
Ruby on Rails=3.0.5-rc1
Ruby on Rails=3.0.6
Ruby on Rails=3.0.6-rc1
Ruby on Rails=3.0.6-rc2
Ruby on Rails=3.0.7
Ruby on Rails=3.0.7-rc1
Ruby on Rails=3.0.7-rc2
Ruby on Rails=3.0.8
Ruby on Rails=3.0.8-rc1
Ruby on Rails=3.0.8-rc2
Ruby on Rails=3.0.8-rc3
Ruby on Rails=3.0.8-rc4
Ruby on Rails=3.0.9
Ruby on Rails=3.0.9-rc1
Ruby on Rails=3.0.9-rc2
Ruby on Rails=3.0.9-rc3
Ruby on Rails=3.0.9-rc4
Ruby on Rails=3.0.9-rc5
Ruby on Rails=3.0.10
Ruby on Rails=3.0.10-rc1
Ruby on Rails=3.0.11
Ruby on Rails=3.0.12-rc1
Ruby on Rails=3.0.4
Ruby on Rails=3.1.0
Ruby on Rails=3.1.0-beta1
Ruby on Rails=3.1.0-rc1
Ruby on Rails=3.1.0-rc2
Ruby on Rails=3.1.0-rc3
Ruby on Rails=3.1.0-rc4
Ruby on Rails=3.1.0-rc5
Ruby on Rails=3.1.0-rc6
Ruby on Rails=3.1.0-rc7
Ruby on Rails=3.1.0-rc8
Ruby on Rails=3.1.1
Ruby on Rails=3.1.1-rc1
Ruby on Rails=3.1.1-rc2
Ruby on Rails=3.1.1-rc3
Ruby on Rails=3.1.2
Ruby on Rails=3.1.2-rc1
Ruby on Rails=3.1.2-rc2
Ruby on Rails=3.1.3
Ruby on Rails=3.1.4-rc1
Ruby on Rails=3.2.0
Ruby on Rails=3.2.0-rc1
Ruby on Rails=3.2.0-rc2
Ruby on Rails=3.2.1
Ruby on Rails=3.2.2-rc1

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2012-1099?

    CVE-2012-1099 is classified as a medium severity cross-site scripting (XSS) vulnerability.

  • How do I fix CVE-2012-1099?

    To fix CVE-2012-1099, upgrade your Ruby on Rails application to the patched versions 3.0.12, 3.1.4, or 3.2.2.

  • Which versions of Ruby on Rails are affected by CVE-2012-1099?

    CVE-2012-1099 affects Ruby on Rails versions 3.0.0 to 3.0.11, and 3.1.0 to 3.1.3.

  • What causes the vulnerability in CVE-2012-1099?

    The vulnerability in CVE-2012-1099 is caused by improper HTML escaping in the 'select' helper method when options are created manually.

  • Is there a workaround for CVE-2012-1099 before applying patches?

    There are no recommended workarounds for CVE-2012-1099; applying the available patches is strongly advised.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203