CVE-2012-3465: XSS

Q: What is the severity of CVE-2012-3465?

CVE-2012-3465 is classified as a high severity cross-site scripting (XSS) vulnerability.

Q: How do I fix CVE-2012-3465?

To remediate CVE-2012-3465, upgrade to Ruby on Rails versions 2.3.16, 3.0.17, 3.1.8, or 3.2.8 and above.

Q: Which versions of Ruby on Rails are affected by CVE-2012-3465?

CVE-2012-3465 affects Ruby on Rails versions prior to 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8.

Q: What kind of attack can CVE-2012-3465 lead to?

CVE-2012-3465 can allow remote attackers to inject arbitrary web scripts or HTML, potentially compromising user data.

Q: Is additional configuration required after fixing CVE-2012-3465?

No additional configuration is required after upgrading to the patched versions addressing CVE-2012-3465.

Published Aug 10, 2012

Updated

Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

Other sources

Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

— NVD

The Ruby on Rails project reports:

XSS Vulnerability in striptags

There is a vulnerability in the striptags helper of Ruby on Rails which could allow an attacker to execute arbitrary javascript. This vulnerability has been assigned the CVE identifier CVE-2012-3465.

Versions Affected: All. Not affected: Applications not using striptags Fixed Versions: 3.2.8, 3.1.8, 3.0.17

Impact - ------ There is an XSS vulnerability in the striptags helper in Ruby on Rails, the helper doesn't correctly handle malformed html. As a result an attacker can execute arbitrary javascript through the use of specially crafted malformed html. All users who rely on striptags for XSS protection should upgrade or use the work around immediately.

Releases - -------- The 3.2.8 and 3.1.8 releases are available at the normal locations.

Workarounds - ----------- For users running earlier releases we have provided a work around, place the attached file into the config/initializers directory of your application.

Patches - ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-0-striptags.patch - Patch for 3.0 series 3-1-striptags.patch - Patch for 3.1 series 3-2-striptags.patch - Patch for 3.2 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits - -------

Thanks to Marek from Nethemba (www.nethemba.com) for reporting this issue!

---

References: http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/

Affected Software

149 affected componentsFixes available

redhat/rubygem-actionpack<3.0.17

3.0.17

redhat/rubygem-actionpack<3.1.8

3.1.8

redhat/rubygem-actionpack<3.2.8

3.2.8

rubygems/actionpack<2.3.16

2.3.16

rubygems/actionpack>=3.0.0.beta<3.0.17

3.0.17

rubygems/actionpack>=3.2.0<3.2.8

3.2.8

rubygems/actionpack>=3.1.0<3.1.8

3.1.8

rubyonrails Rails=0.9.1

rubyonrails Rails=0.9.2

rubyonrails Rails=0.9.3

rubyonrails Rails=0.9.4

rubyonrails Rails=0.9.4.1

rubyonrails Rails=0.10.0

rubyonrails Rails=0.10.1

rubyonrails Rails=0.11.0

rubyonrails Rails=0.11.1

rubyonrails Rails=0.12.0

rubyonrails Rails=0.12.1

rubyonrails Rails=0.13.0

rubyonrails Rails=0.13.1

rubyonrails Rails=0.14.1

rubyonrails Rails=0.14.2

rubyonrails Rails=0.14.3

rubyonrails Rails=0.14.4

rubyonrails Rails=1.0.0

rubyonrails Rails=1.1.0

rubyonrails Rails=1.1.1

rubyonrails Rails=1.1.2

rubyonrails Rails=1.1.3

rubyonrails Rails=1.1.4

rubyonrails Rails=1.1.5

rubyonrails Rails=1.1.6

rubyonrails Rails=1.2.0

rubyonrails Rails=1.2.1

rubyonrails Rails=1.2.2

rubyonrails Rails=1.2.3

rubyonrails Rails=1.2.4

rubyonrails Rails=1.2.5

rubyonrails Rails=1.2.6

rubyonrails Rails=1.9.5

rubyonrails Rails=2.0.0

rubyonrails Rails=2.0.0-rc1

rubyonrails Rails=2.0.0-rc2

rubyonrails Rails=2.0.1

rubyonrails Rails=2.0.2

rubyonrails Rails=2.0.4

rubyonrails Rails=2.1.0

rubyonrails Rails=2.1.1

rubyonrails Rails=2.1.2

rubyonrails Rails=2.2.0

rubyonrails Rails=2.2.1

rubyonrails Rails=2.2.2

rubyonrails Rails=2.3.2

rubyonrails Rails=2.3.3

rubyonrails Rails=2.3.4

rubyonrails Rails=2.3.9

rubyonrails Rails=2.3.10

rubyonrails Rails=2.3.11

rubyonrails Rails=2.3.12

rubyonrails Rails=3.0.0

rubyonrails Rails=3.0.0-beta

rubyonrails Rails=3.0.0-beta2

rubyonrails Rails=3.0.0-beta3

rubyonrails Rails=3.0.0-beta4

rubyonrails Rails=3.0.0-rc

rubyonrails Rails=3.0.0-rc2

rubyonrails Rails=3.0.1

rubyonrails Rails=3.0.1-pre

rubyonrails Rails=3.0.2

rubyonrails Rails=3.0.2-pre

rubyonrails Rails=3.0.3

rubyonrails Rails=3.0.4-rc1

rubyonrails Rails=3.0.5

rubyonrails Rails=3.0.5-rc1

rubyonrails Rails=3.0.6

rubyonrails Rails=3.0.6-rc1

rubyonrails Rails=3.0.6-rc2

rubyonrails Rails=3.0.7

rubyonrails Rails=3.0.7-rc1

rubyonrails Rails=3.0.7-rc2

rubyonrails Rails=3.0.8

rubyonrails Rails=3.0.8-rc1

rubyonrails Rails=3.0.8-rc2

rubyonrails Rails=3.0.8-rc3

rubyonrails Rails=3.0.8-rc4

rubyonrails Rails=3.0.9

rubyonrails Rails=3.0.9-rc1

rubyonrails Rails=3.0.9-rc2

rubyonrails Rails=3.0.9-rc3

rubyonrails Rails=3.0.9-rc4

rubyonrails Rails=3.0.9-rc5

rubyonrails Rails=3.0.10

rubyonrails Rails=3.0.10-rc1

rubyonrails Rails=3.0.11

rubyonrails Rails=3.0.12

rubyonrails Rails=3.0.12-rc1

rubyonrails Rails=3.0.13

rubyonrails Rails=3.0.13-rc1

rubyonrails Rails=3.0.14

rubyonrails ruby on Rails<=3.0.16

rubyonrails ruby on Rails=0.5.0

rubyonrails ruby on Rails=0.5.5

rubyonrails ruby on Rails=0.5.6

rubyonrails ruby on Rails=0.5.7

rubyonrails ruby on Rails=0.6.0

rubyonrails ruby on Rails=0.6.5

rubyonrails ruby on Rails=0.7.0

rubyonrails ruby on Rails=0.8.0

rubyonrails ruby on Rails=0.8.5

rubyonrails ruby on Rails=0.9.0

rubyonrails ruby on Rails=3.0.4

rubyonrails Rails=3.1.0

rubyonrails Rails=3.1.0-beta1

rubyonrails Rails=3.1.0-rc1

rubyonrails Rails=3.1.0-rc2

rubyonrails Rails=3.1.0-rc3

rubyonrails Rails=3.1.0-rc4

rubyonrails Rails=3.1.0-rc5

rubyonrails Rails=3.1.0-rc6

rubyonrails Rails=3.1.0-rc7

rubyonrails Rails=3.1.0-rc8

rubyonrails Rails=3.1.1

rubyonrails Rails=3.1.1-rc1

rubyonrails Rails=3.1.1-rc2

rubyonrails Rails=3.1.1-rc3

rubyonrails Rails=3.1.2

rubyonrails Rails=3.1.2-rc1

rubyonrails Rails=3.1.2-rc2

rubyonrails Rails=3.1.3

rubyonrails Rails=3.1.4

rubyonrails Rails=3.1.4-rc1

rubyonrails Rails=3.1.5

rubyonrails Rails=3.1.5-rc1

rubyonrails Rails=3.1.6

rubyonrails Rails=3.1.7

rubyonrails Rails=3.2.0

rubyonrails Rails=3.2.0-rc1

rubyonrails Rails=3.2.0-rc2

rubyonrails Rails=3.2.1

rubyonrails Rails=3.2.2

rubyonrails Rails=3.2.2-rc1

rubyonrails Rails=3.2.3

rubyonrails Rails=3.2.3-rc1

rubyonrails Rails=3.2.3-rc2

rubyonrails Rails=3.2.4

rubyonrails Rails=3.2.4-rc1

rubyonrails Rails=3.2.5

rubyonrails Rails=3.2.6

rubyonrails Rails=3.2.7

Event History

Aug 10, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Oct 24, 2017

Advisory Published

via GitHub·06:33 PM

Frequently Asked Questions

What is the severity of CVE-2012-3465?

CVE-2012-3465 is classified as a high severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2012-3465?

To remediate CVE-2012-3465, upgrade to Ruby on Rails versions 2.3.16, 3.0.17, 3.1.8, or 3.2.8 and above.

Which versions of Ruby on Rails are affected by CVE-2012-3465?

CVE-2012-3465 affects Ruby on Rails versions prior to 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8.

What kind of attack can CVE-2012-3465 lead to?