CVE-2012-3464
activesupport Cross-site Scripting vulnerability
EPSS 0.24%
Description
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
How to fix CVE-2012-3464
To remediate CVE-2012-3464, upgrade the affected package to a fixed version below.
- Debian/rails—upgrade to 2.3.14.1 or later
- RubyGems/activesupport—upgrade to 3.0.17 or later
Is CVE-2012-3464 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2.3.14.1
- >= 3.0.0.beta, < 3.0.17