Ruby on Rails 'strip _ tags () 'Cross-Site Scripting Vulnerability

Release date:
Updated on:

Affected Systems:
Ruby on Rails 3.x
Ruby on Rails 2.x
Ruby on Rails 1.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54957
Cve id: CVE-2012-3465

Ruby on Rails (RoR or Rails) is an open-source Web application framework written in Ruby. It is developed in strict accordance with the MVC structure.

Ruby on Rails 3.0.17 3. there is an XSS vulnerability in the implementation of actionpack/lib/action_view/helpers/sanitize_helper.rb in Version x, version 3.1.x earlier than Version 3.1.8, and version 3.2.x earlier than version 3.2.8, remote attackers can inject arbitrary Web scripts or HTML through malformed HTML tags.

<* Source: vendor
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Ruby on Rails
-------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.rubyonrails.com/