CVE-2015-1840
No CVSS score yet. EPSS 4.5% chance of exploitation in the next 30 days. Fixed in jquery-rails 3.1.3, 4.0.4.
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- EPSS
- 4.5% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- opensuse:opensuse
- rubyonrails:jquery-rails
- rubyonrails:jquery-ujs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4whc-pp4x-9pf3 | RubyGems | jquery-rails | <3.1.3 | 3.1.3 |
| GHSA-4whc-pp4x-9pf3 | RubyGems | jquery-rails | >=4.0.0 <4.0.4 | 4.0.4 |
| GHSA-4whc-pp4x-9pf3 | RubyGems | jquery-ujs | <1.0.4 | 1.0.4 |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00041.html
- http://openwall.com/lists/oss-security/2015/06/16/15
- http://www.securityfocus.com/bid/75239