CVE-2009-4214

描述

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

如何修補 CVE-2009-4214

要修補 CVE-2009-4214,請將受影響套件升級到下列已修補版本。

• Debian/rails—升級至 2.2.3-2 或更新版本
• Debian/rails—升級至 2.3.5-1.2+squeeze1 或更新版本
• RubyGems/rails—升級至 2.2.2 或更新版本

CVE-2009-4214 正在被利用嗎?

低 — EPSS 為 3.0%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 2.2.3-2
• from 0, < 2.3.5-1.2+squeeze1
• from 0, < 2.2.2

參考連結(20)

• ADVISORYgithub.com/advisories/GHSA-9p3v-wf2w-v29c
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2009-4214
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2009-4214
• PATCHgithub.com/rails/rails
• WEB