CVE-2012-1098

Executive Summary

Informations
Name	CVE-2012-1098	First vendor Publication	2012-03-13
Vendor	Cve	Last vendor Modification	2012-07-06

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score	4.3	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1098

CWE : Common Weakness Enumeration

id	Name
CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting')

CPE : Common Platform Enumeration

Type	Description	Count
Application	Rubyonrails Ruby On Rails cpe:/a:rubyonrails:ruby_on_rails:3.2.2:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.2.1 cpe:/a:rubyonrails:ruby_on_rails:3.2.0 cpe:/a:rubyonrails:ruby_on_rails:3.2.0:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.2.0:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.4:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.3 cpe:/a:rubyonrails:ruby_on_rails:3.1.2 cpe:/a:rubyonrails:ruby_on_rails:3.1.2:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.2:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.1.1 cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.1.1:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:beta1 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc5 cpe:/a:rubyonrails:ruby_on_rails:3.1.0 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc6 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc7 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc8 cpe:/a:rubyonrails:ruby_on_rails:3.1.0:rc4 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc5 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc4 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.9:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.0.9 cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc3 cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc4 cpe:/a:rubyonrails:ruby_on_rails:3.0.8 cpe:/a:rubyonrails:ruby_on_rails:3.0.8:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.7 cpe:/a:rubyonrails:ruby_on_rails:3.0.7:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.7:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.6:rc2 cpe:/a:rubyonrails:ruby_on_rails:3.0.6 cpe:/a:rubyonrails:ruby_on_rails:3.0.6:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.5 cpe:/a:rubyonrails:ruby_on_rails:3.0.5:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.4:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.4:rc cpe:/a:rubyonrails:ruby_on_rails:3.0.4 cpe:/a:rubyonrails:ruby_on_rails:3.0.3 cpe:/a:rubyonrails:ruby_on_rails:3.0.2:pre cpe:/a:rubyonrails:ruby_on_rails:3.0.2 cpe:/a:rubyonrails:ruby_on_rails:3.0.12:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.11 cpe:/a:rubyonrails:ruby_on_rails:3.0.10 cpe:/a:rubyonrails:ruby_on_rails:3.0.10:rc1 cpe:/a:rubyonrails:ruby_on_rails:3.0.1 cpe:/a:rubyonrails:ruby_on_rails:3.0.1:pre cpe:/a:rubyonrails:ruby_on_rails:3.0.0:rc cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta3 cpe:/a:rubyonrails:ruby_on_rails:3.0.0 cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta4 cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta cpe:/a:rubyonrails:ruby_on_rails:3.0.0:beta2 cpe:/a:rubyonrails:ruby_on_rails:3.0.0:rc2	62

Internal Sources (Detail)

Source	Url
CONFIRM	http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released https://bugzilla.redhat.com/show_bug.cgi?id=799275
MLIST	http://groups.google.com/group/rubyonrails-security/msg/1c2e01a5e42722c9?dmod... http://www.openwall.com/lists/oss-security/2012/03/02/6 http://www.openwall.com/lists/oss-security/2012/03/03/1

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-10 22:34:42	Multiple Updates

CVE-2012-1098

Executive Summary

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

CPE : Common Platform Enumeration

Internal Sources (Detail)

Alert History

Global Informations

Open Standards

COMPANY

STANDARDS

RECENT POSTS

MENU