CVE-2015-7579: XSS
Published Feb 16, 2016
·Updated
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
Affected Software
29 affected components
rubyonrails Html Sanitizer Ruby<=1.0.2
rubyonrails Rails=4.2.0
rubyonrails Rails=4.2.0-beta1
rubyonrails Rails=4.2.0-beta2
rubyonrails Rails=4.2.0-beta3
rubyonrails Rails=4.2.0-beta4
rubyonrails Rails=4.2.0-rc1
rubyonrails Rails=4.2.0-rc2
rubyonrails Rails=4.2.0-rc3
rubyonrails Rails=4.2.1
rubyonrails Rails=4.2.1-rc1
rubyonrails Rails=4.2.1-rc2
rubyonrails Rails=4.2.1-rc3
rubyonrails Rails=4.2.1-rc4
rubyonrails Rails=4.2.2
rubyonrails Rails=4.2.3
rubyonrails Rails=4.2.3-rc1
rubyonrails Rails=4.2.4
rubyonrails Rails=4.2.4-rc1
rubyonrails Rails=4.2.5
rubyonrails Rails=4.2.5-rc1
rubyonrails Rails=4.2.5-rc2
rubyonrails Rails=4.2.5.1
rubyonrails Rails=4.2.5.2
rubyonrails Rails=4.2.6-rc1
rubyonrails Rails=5.0.0-beta1
rubyonrails Rails=5.0.0-beta1.1
rubyonrails Rails=5.0.0-beta2
rubyonrails Rails=5.0.0-beta3
Event History
Feb 16, 2016
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7579?
CVE-2015-7579 has a high severity level due to its potential to allow remote attackers to execute arbitrary web scripts or HTML.
2
How do I fix CVE-2015-7579?
To fix CVE-2015-7579, upgrade the rails-html-sanitizer gem to version 1.0.3 or later.
3
Which versions are affected by CVE-2015-7579?
CVE-2015-7579 affects rails-html-sanitizer gem versions up to and including 1.0.2.
4
What type of vulnerability is CVE-2015-7579?
CVE-2015-7579 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2015-7579 impact my Ruby on Rails application?
Yes, if you are using an affected version of the rails-html-sanitizer gem in your Ruby on Rails application, it can be exploited by attackers.