Rails actionpack gem vulnerable to Cross-site Scripting

中危 4.3CVE-2011-0446 · GHSA-75w6-p6mg-vh8j · Published 14/02/2011 · updated 16/06/2026

Package	Affected versions	Patched versions
actionpack RubyGems	`≥ 3.0.0, < 3.0.4< 2.3.11`	`3.0.42.3.11`
actionview RubyGems	`≥ 3.0.0, < 3.0.4< 2.3.11`	`3.0.42.3.11`
rails rubyonrails	`= 2.0.0= 2.0.1= 2.0.2= 2.0.4= 2.1.0= 2.1.1= 2.1.2= 2.2.0= 2.2.1= 2.2.2= 2.3.10= 2.3.2= 2.3.3= 2.3.4= 2.3.9= 3.0.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.

NVD description

Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.

References

nvd.nist.gov/vuln/detail/CVE-2011-0446 · ADVISORY
rails/rails commit abe9773 · WEB
rails/rails commit e3dd210 · WEB
rails/rails · PACKAGE
rubysec/ruby-advisory-db · WEB
rubysec/ruby-advisory-db · WEB
groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ · WEB
web.archive.org/web/20111225083933/http://secunia.com/advisories/43274 · WEB
web.archive.org/web/20111225083933/http://secunia.com/advisories/43666 · WEB
web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free