onyx --cves cve-2013-1857
CVE-2013-1857
- score
- <0.1
- cvss
- 4.3
- epss
- 1.9%
- published
- 2013-03-19
- kev added
- —
- first seen
Ruby on Rails before 2.3.18, 3.0.x, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 contain a cross-site scripting caused by improper handling of encoded colon characters in URLs within the sanitize helper in sanitizer.rb, letting remote attackers execute malicious scripts via crafted scheme names, exploit requires crafting URLs with encoded colon sequences.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 10
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
- http://rhn.redhat.com/errata/RHSA-2013-0698.html
- http://rhn.redhat.com/errata/RHSA-2014-1863.html
- https://groups.google.com/group/rubyonrails-security/msg/78b9817a5943f6d6?dmode=source&output=gplain
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
- http://support.apple.com/kb/HT5784
- http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/