Kurz gesagt
- CVE-2017-1002201 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in haml, haml (haml).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 73.6% aller Schwachstellen.
- Abhilfe: auf 5.0.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| haml RubyGems | < 5.0.0
| 5.0.0
|
| haml | < 5.0.0
| 5.0.0
|
Description
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
NVD description
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free