CVE-2017-12098

MEDIUM

rails_admin 1.2.0 - Stored Cross-Site Scripting via Add Filter Functionality

Title source: llm

Description

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

References (2)

Core 2

Core References

Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102486

Exploit, Third Party Advisory x_refsource_misc

https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450

Scores

CVSS v3 6.1

EPSS 0.0040

EPSS Percentile 60.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

rails_admin_project/rails_admin 1.2.0

rubygems/rails_admin 0 - 1.3.0RubyGems

Published Jan 19, 2018

Tracked Since Feb 18, 2026