CVE-2011-2197
Summary
| CVE | CVE-2011-2197 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-06-30 15:55:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Rubyonrails | Rails | 2.0.0 | All | All | All |
| Application | Rubyonrails | Rails | 2.0.0 | rc1 | All | All |
| Application | Rubyonrails | Rails | 2.0.0 | rc2 | All | All |
| Application | Rubyonrails | Rails | 2.0.1 | All | All | All |
| Application | Rubyonrails | Rails | 2.0.2 | All | All | All |
| Application | Rubyonrails | Rails | 2.0.4 | All | All | All |
| Application | Rubyonrails | Rails | 2.1.0 | All | All | All |
| Application | Rubyonrails | Rails | 2.1.1 | All | All | All |
| Application | Rubyonrails | Rails | 2.1.2 | All | All | All |
| Application | Rubyonrails | Rails | 2.2.0 | All | All | All |
| Application | Rubyonrails | Rails | 2.2.1 | All | All | All |
| Application | Rubyonrails | Rails | 2.2.2 | All | All | All |
| Application | Rubyonrails | Rails | 2.3.10 | All | All | All |
| Application | Rubyonrails | Rails | 2.3.11 | All | All | All |
| Application | Rubyonrails | Rails | 2.3.2 | All | All | All |
| Application | Rubyonrails | Rails | 2.3.3 | All | All | All |
| Application | Rubyonrails | Rails | 2.3.4 | All | All | All |
| Application | Rubyonrails | Rails | 2.3.9 | All | All | All |
| Application | Rubyonrails | Rails | 3.0.0 | All | All | All |
| Application | Rubyonrails | Rails | 3.0.0 | beta | All | All |
| Application | Rubyonrails | Rails | 3.0.0 | beta2 | All | All |
| Application | Rubyonrails | Rails | 3.0.0 | beta3 | All | All |
| Application | Rubyonrails | Rails | 3.0.0 | beta4 | All | All |
| Application | Rubyonrails | Rails | 3.0.0 | rc | All | All |
| Application | Rubyonrails | Rails | 3.0.0 | rc2 | All | All |
| Application | Rubyonrails | Rails | 3.0.1 | All | All | All |
| Application | Rubyonrails | Rails | 3.0.1 | pre | All | All |
| Application | Rubyonrails | Rails | 3.0.2 | All | All | All |
| Application | Rubyonrails | Rails | 3.0.2 | pre | All | All |
| Application | Rubyonrails | Rails | 3.0.3 | All | All | All |
| Application | Rubyonrails | Rails | 3.0.4 | rc1 | All | All |
| Application | Rubyonrails | Rails | 3.0.5 | All | All | All |
| Application | Rubyonrails | Rails | 3.0.5 | rc1 | All | All |
| Application | Rubyonrails | Rails | 3.0.6 | All | All | All |
| Application | Rubyonrails | Rails | 3.0.6 | rc1 | All | All |
| Application | Rubyonrails | Rails | 3.0.6 | rc2 | All | All |
| Application | Rubyonrails | Rails | 3.0.7 | All | All | All |
| Application | Rubyonrails | Rails | 3.0.7 | rc1 | All | All |
| Application | Rubyonrails | Rails | 3.0.7 | rc2 | All | All |
| Application | Rubyonrails | Rails | 3.0.8 | rc1 | All | All |
| Application | Rubyonrails | Rails | 3.0.8 | rc2 | All | All |
| Application | Rubyonrails | Rails | 3.0.8 | rc3 | All | All |
| Application | Rubyonrails | Rails | 3.0.8 | rc4 | All | All |
| Application | Rubyonrails | Rails | 3.1.0 | All | All | All |
| Application | Rubyonrails | Rails | 3.1.0 | beta1 | All | All |
| Application | Rubyonrails | Rails | 3.1.0 | rc1 | All | All |
| Application | Rubyonrails | Ruby On Rails | 3.0.4 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - CVE Request: Ruby on Rails 3/rails_xss XSS | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Patch |
| Ruby on Rails Safe Buffer Cross-Site Scripting Weakness - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| oss-security - Re: CVE Request: Ruby on Rails 3/rails_xss XSS | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Patch |
| Google Groups | af854a3a-2127-422b-91ae-364da2661108 | groups.google.com | Patch |
| [SECURITY] Fedora 15 Update: rubygem-actionpack-3.0.5-3.fc15 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Riding Rails: Potential XSS Vulnerability in Ruby on Rails Applications | af854a3a-2127-422b-91ae-364da2661108 | weblog.rubyonrails.org | Patch |
| [SECURITY] Fedora 15 Update: rubygem-activesupport-3.0.5-3.fc15 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.