CVE-2011-4319: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
(updated )
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an “html” substring.
References
- groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1
- groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain
- openwall.com/lists/oss-security/2011/11/18/8
- osvdb.org/77199
- weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released
- weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released
- www.securityfocus.com/bid/50722
- www.securitytracker.com/id?1026342
- exchange.xforce.ibmcloud.com/vulnerabilities/71364
- github.com/advisories/GHSA-xxr8-833v-c7wc
- nvd.nist.gov/vuln/detail/CVE-2011-4319
Code Behaviors & Features
Detect and mitigate CVE-2011-4319 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →