CVE-2015-7580: XSS

Q: What is the severity of CVE-2015-7580?

CVE-2015-7580 is considered to have a moderate severity level due to its impact on web application security.

Q: How do I fix CVE-2015-7580?

To fix CVE-2015-7580, update the rails-html-sanitizer gem to version 1.0.3 or later.

Q: What versions of Ruby on Rails are affected by CVE-2015-7580?

Versions of Ruby on Rails 4.2.x and 5.x prior to the update of the rails-html-sanitizer gem to 1.0.3 are affected by CVE-2015-7580.

Q: What type of vulnerability is CVE-2015-7580?

CVE-2015-7580 is a cross-site scripting (XSS) vulnerability.

Q: Can CVE-2015-7580 lead to remote attacks?

Yes, CVE-2015-7580 allows remote attackers to inject arbitrary web scripts or HTML, which can compromise the integrity of web applications.

Published Feb 16, 2016

Updated

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.

Affected Software

29 affected components

rubyonrails Html Sanitizer Ruby<=1.0.2

rubyonrails Rails=4.2.0

rubyonrails Rails=4.2.0-beta1

rubyonrails Rails=4.2.0-beta2

rubyonrails Rails=4.2.0-beta3

rubyonrails Rails=4.2.0-beta4

rubyonrails Rails=4.2.0-rc1

rubyonrails Rails=4.2.0-rc2

rubyonrails Rails=4.2.0-rc3

rubyonrails Rails=4.2.1

rubyonrails Rails=4.2.1-rc1

rubyonrails Rails=4.2.1-rc2

rubyonrails Rails=4.2.1-rc3

rubyonrails Rails=4.2.1-rc4

rubyonrails Rails=4.2.2

rubyonrails Rails=4.2.3

rubyonrails Rails=4.2.3-rc1

rubyonrails Rails=4.2.4

rubyonrails Rails=4.2.4-rc1

rubyonrails Rails=4.2.5

rubyonrails Rails=4.2.5-rc1

rubyonrails Rails=4.2.5-rc2

rubyonrails Rails=4.2.5.1

rubyonrails Rails=4.2.5.2

rubyonrails Rails=4.2.6-rc1

rubyonrails Rails=5.0.0-beta1

rubyonrails Rails=5.0.0-beta1.1

rubyonrails Rails=5.0.0-beta2

rubyonrails Rails=5.0.0-beta3

Event History

Feb 16, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-7580?

CVE-2015-7580 is considered to have a moderate severity level due to its impact on web application security.

How do I fix CVE-2015-7580?

To fix CVE-2015-7580, update the rails-html-sanitizer gem to version 1.0.3 or later.

What versions of Ruby on Rails are affected by CVE-2015-7580?

Versions of Ruby on Rails 4.2.x and 5.x prior to the update of the rails-html-sanitizer gem to 1.0.3 are affected by CVE-2015-7580.

What type of vulnerability is CVE-2015-7580?

CVE-2015-7580 is a cross-site scripting (XSS) vulnerability.

Can CVE-2015-7580 lead to remote attacks?