Rails actionpack gem vulnerable to Cross-site Scripting (GHSA-75w6-p6mg-vh8j)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2011-0446
Severity: MODERATE · CWE: CWE-79

Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.

Affected packages:
package: ecosystem: RubyGems
name: actionpack
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.11
package: ecosystem: RubyGems
name: actionpack
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.4
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.11
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.4