| Package | Affected versions | Patched versions |
|---|---|---|
| jquery-rails | ≥ 4.0.0, < 4.0.4< 3.1.3 | 4.0.43.1.3 |
| jquery-ujs | < 1.0.4 | 1.0.4 |
| jquery-rails | = 4.0.0= 4.0.1≤ 3.1.2 | |
| jquery-ujs | ≤ 1.0.3 |
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free