Multiple Cross-Site Scripting Vulnerabilities in Ruby on Rails

Release date:
Updated on:

Affected Systems:
Ruby on Rails 3.2.x
Ruby on Rails 3.1.x
Ruby on Rails 3.0.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52264

Ruby on Rails (RoR or Rails) is an open-source Web application framework written in Ruby. It is developed in strict accordance with the MVC structure.

The input passed through the direct operation in SafeBuffer is not properly filtered. Some inputs passed by manually generated selection tags are not properly filtered, resulting in arbitrary HTML and script code execution in the user's browser.

<* Source: Akira Matsuda

Link: http://groups.google.com/group/rubyonrails-security/browse_thread/thread/edd28f1e3d04e913
Https://bugzilla.redhat.com/show_bug.cgi? Id = 799275

*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Ruby
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.ruby-lang.org/en/