MEDIUM6.1

GHSA-pxr8-w3jq-rcwj

rails_admin ruby gem XSS

Quick fix

GHSA-pxr8-w3jq-rcwj — rails_admin: upgrade to the fixed version with the command below.

bundle update rails_admin

Details

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/rails_admin

Introduced in: 0Fixed in: 1.3.0

Fixbundle update rails_admin

References

https://nvd.nist.gov/vuln/detail/CVE-2017-12098[ADVISORY]
https://github.com/advisories/GHSA-pxr8-w3jq-rcwj[ADVISORY]
https://github.com/railsadminteam/rails_admin[WEB]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_admin/CVE-2017-12098.yml[WEB]
https://web.archive.org/web/20210116160904/http://www.securityfocus.com/bid/102486[WEB]
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450[WEB]