CVE-2017-12097

MEDIUM

delayed_job_web 1.4 - Stored Cross-Site Scripting via Filter Functionality

Title source: llm

Description

An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

References (2)

Core 2

Core References

Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102484

Exploit, Third Party Advisory x_refsource_misc

https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0449

Scores

CVSS v3 6.1

EPSS 0.0040

EPSS Percentile 60.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

delayed_job_web_project/delayed_job_web 1.4

rubygems/delayed_job_web 1.2.9 - 1.4.2RubyGems

Published Jan 19, 2018

Tracked Since Feb 18, 2026