CVE-2011-0446
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-75w6-p6mg-vh8j | RubyGems | actionpack | <2.3.11 | 2.3.11 |
| GHSA-75w6-p6mg-vh8j | RubyGems | actionpack | >=3.0.0 <3.0.4 | 3.0.4 |
| GHSA-75w6-p6mg-vh8j | RubyGems | actionview | <2.3.11 | 2.3.11 |
| GHSA-75w6-p6mg-vh8j | RubyGems | actionview | >=3.0.0 <3.0.4 | 3.0.4 |
References
- http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
- http://secunia.com/advisories/43274