CVE-2009-4214
Fixed in a distro release EPSS 3%
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
Products: rubyonrails rails, rubyonrails ruby_on_rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rails | 2.2.2 |
| RubyGems | rails | 2.3.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2.2.3-2 |
| Debian 13 | rails | 2.2.3-2 |
| Debian 14 | rails | 2.2.3-2 |
| Debian 5.0 | rails | 2.1.0-7+lenny0.2 |
| Debian 5.0 | rails | 2.1.0-7+lenny1 |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze1 |