Description

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

Remediation

References

CVE-2012-3465

Related Vulnerabilities

ownCloud Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3834)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-5732)

WordPress Plugin BuddyPress Multiple Vulnerabilities (1.9.1)

MySQL CVE-2015-4807 Vulnerability (CVE-2015-4807)

WordPress Plugin Sell Downloads Unspecified Vulnerability (1.0.85)

Severity

Medium

Classification

CVE-2012-3465 CWE-707

Tags

Missing Update Known Vulnerabilities