CVE-2012-1099

Ruby on Rails <3.0.12-3.2.2 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.

References (8)

[Mailing List] http://groups.google.com/group/rubyonrails-security/msg/6fca4f5c47705488?dmode=source&output=gplain

[Various Sources] http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=799276

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075740.html

[Third Party Advisory] http://www.debian.org/security/2012/dsa-2466

[Mailing List] http://www.openwall.com/lists/oss-security/2012/03/02/6

[Mailing List] http://www.openwall.com/lists/oss-security/2012/03/03/1

Scores

EPSS 0.0040

EPSS Percentile 60.3%

Classification

CWE

CWE-79

Status published

Affected Products (50)

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

rubyonrails/rails

... and 35 more

Timeline

Published Mar 13, 2012

Tracked Since Feb 18, 2026