CVE-2015-7578: XSS
Published Feb 16, 2016
·Updated
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
Affected Software
29 affected components
rubyonrails Html Sanitizer Ruby<=1.0.2
rubyonrails Rails=4.2.0
rubyonrails Rails=4.2.0-beta1
rubyonrails Rails=4.2.0-beta2
rubyonrails Rails=4.2.0-beta3
rubyonrails Rails=4.2.0-beta4
rubyonrails Rails=4.2.0-rc1
rubyonrails Rails=4.2.0-rc2
rubyonrails Rails=4.2.0-rc3
rubyonrails Rails=4.2.1
rubyonrails Rails=4.2.1-rc1
rubyonrails Rails=4.2.1-rc2
rubyonrails Rails=4.2.1-rc3
rubyonrails Rails=4.2.1-rc4
rubyonrails Rails=4.2.2
rubyonrails Rails=4.2.3
rubyonrails Rails=4.2.3-rc1
rubyonrails Rails=4.2.4
rubyonrails Rails=4.2.4-rc1
rubyonrails Rails=4.2.5
rubyonrails Rails=4.2.5-rc1
rubyonrails Rails=4.2.5-rc2
rubyonrails Rails=4.2.5.1
rubyonrails Rails=4.2.5.2
rubyonrails Rails=4.2.6-rc1
rubyonrails Rails=5.0.0-beta1
rubyonrails Rails=5.0.0-beta1.1
rubyonrails Rails=5.0.0-beta2
rubyonrails Rails=5.0.0-beta3
Event History
Feb 16, 2016
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7578?
CVE-2015-7578 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2015-7578?
To fix CVE-2015-7578, update the rails-html-sanitizer gem to version 1.0.3 or later.
3
Who is affected by CVE-2015-7578?
CVE-2015-7578 affects applications using the rails-html-sanitizer gem prior to version 1.0.3 in Ruby on Rails 4.2.x and 5.x.
4
What type of vulnerability is CVE-2015-7578?
CVE-2015-7578 is classified as a cross-site scripting (XSS) vulnerability.
5
Can CVE-2015-7578 lead to data breaches?
Yes, CVE-2015-7578 could potentially lead to data breaches if an attacker exploits the XSS vulnerability.