PT-2009-5349

CVE-2009-3009

Published

2009-09-08

Updated

2019-08-08

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions 2.x prior to 2.2.3 Ruby on Rails versions 2.3.x prior to 2.3.4

Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

Recommendations: For Ruby on Rails versions 2.x prior to 2.2.3, update to version 2.2.3 or later. For Ruby on Rails versions 2.3.x prior to 2.3.4, update to version 2.3.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Brian Mastenbrook

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2009-3009