Peter Mclarnan

**Name of the Vulnerable Software and Affected Versions** Ruby on Rails versions 3.x through 3.2.15 Ruby on Rails versions 4.x through 4.0.1 **Description** A cross-site scripting (XSS) issue exists in the internationalization component, allowing remote attackers to inject arbitrary web script or HTML via a crafted string. This string triggers the generation of a fallback string by the i18n gem, which is used in the `actionpack/lib/action view/helpers/translation helper.rb` file. **Recommendations** For Ruby on Rails versions 3.x through 3.2.15, update to version 3.2.16 or later. For Ruby on Rails versions 4.x through 4.0.1, update to version 4.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Ruby on Rails versions prior to 3.2.16 Ruby on Rails versions 4.x prior to 4.0.2 **Description** The issue arises from improper consideration of differences in parameter handling between the Active Record component and the JSON implementation in `actionpack/lib/action dispatch/http/request.rb`. This allows remote attackers to bypass intended database-query restrictions, perform NULL checks, or trigger missing WHERE clauses via a crafted request. The request can leverage third-party Rack middleware or custom Rack middleware to exploit this issue. **Recommendations** For Ruby on Rails versions prior to 3.2.16, update to version 3.2.16 or later. For Ruby on Rails versions 4.x prior to 4.0.2, update to version 4.0.2 or later. As a temporary workaround, consider restricting access to custom Rack middleware and third-party Rack middleware until a patch is applied.