This host is running Ruby on Rails and is prone to cross-site scripting vulnerability.

Successful exploitation will allow attackers to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Impact Level: Application

Upgrade to Ruby on Rails version 2.3.12 or 3.0.8 or 3.1.0.rc2 or later. For updates refer to http://rubyonrails.org/download Apply the patch for Ruby on Rails versions 3.1.0.rc1, 3.0.7 and 2.3.11 from below link. http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications

The flaw is due to certain methods not properly handling the 'HTML safe' mark for strings, which can lead to improperly sanitised input being returned to the user.

Ruby on Rails version 2.x before 2.3.12, 3.0.x before 3.0.8 and 3.1.x before 3.1.0.rc2.

• http://secunia.com/advisories/44789
• http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications

---

Updated on 2015-03-25