i18n gem Cross-site Scripting vulnerability

MEDIO 4.3CVE-2013-4492 · GHSA-r5hc-9xx5-97rw · Published 07/12/2013 · updated 16/06/2026

In breve

CVE-2013-4492 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda i18n, i18n (i18n project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.2%, superiore al 82.8% delle vulnerabilità.
Correzione: aggiornare a 0.6.6 o successiva.

Package	Affected versions	Patched versions
i18n RubyGems	`< 0.6.6`	`0.6.6`
i18n i18n_project	`≤ 0.6.5`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-4492 · ADVISORY
ruby-i18n/i18n commit 92b57b1 · WEB
svenfuchs/i18n commit 92b57b1 · WEB
access.redhat.com/errata/RHBA-2015:1100 · WEB
access.redhat.com/errata/RHSA-2017:0320 · WEB
access.redhat.com/errata/RHSA-2018:0380 · WEB
access.redhat.com/security/cve/CVE-2013-4492 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
GitHub Advisory GHSA-r5hc-9xx5-97rw · ADVISORY
rubysec/ruby-advisory-db · WEB
svenfuchs/i18n · PACKAGE
groups.google.com/forum · WEB
web.archive.org/web/20201208125214/https://groups.google.com/forum/message/raw · WEB
web.archive.org/web/20210731082547/http://www.securityfocus.com/bid/64076 · WEB
lists.opensuse.org/opensuse-updates/2013-12/msg00093.html · WEB
weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released · WEB
debian.org/security/2013/dsa-2830 · WEB
weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released · Patch
securityfocus.com/bid/64076
groups.google.com/forum/message/raw

Altre vulnerabilità di i18n

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free