MEDIUM
GHSA-gm25-fpmr-43fj
Moderate severity vulnerability that affects rails
Quick fix
GHSA-gm25-fpmr-43fj — rails: upgrade to the fixed version with the command below.
bundle update railsDetails
Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2007-3227[ADVISORY]
- https://github.com/advisories/GHSA-gm25-fpmr-43fj[ADVISORY]
- https://github.com/rails/rails[PACKAGE]
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-3227.yml[WEB]
- http://bugs.gentoo.org/show_bug.cgi?id=195315[WEB]
- http://dev.rubyonrails.org/ticket/8371[WEB]
- http://osvdb.org/36378[WEB]
- http://pastie.caboo.se/65550.txt[WEB]
- http://secunia.com/advisories/25699[WEB]
- http://secunia.com/advisories/27657[WEB]
- http://secunia.com/advisories/27756[WEB]
- http://security.gentoo.org/glsa/glsa-200711-17.xml[WEB]
- http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release[WEB]
- http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release[WEB]
- http://www.novell.com/linux/security/advisories/2007_24_sr.html[WEB]
- http://www.securityfocus.com/bid/24161[WEB]
- http://www.vupen.com/english/advisories/2007/2216[WEB]