CVE-2012-1098

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

基于Rails 3.0.12之前的3.0.x版本，3.1.4版本之前的3.1.x版本，与3.2.2之前的3.2.x版本的Ruby中存在跨站脚本漏洞。远程攻击者可利用该漏洞借助涉及通过某些方法操作的SafeBuffer对象的向量，注入任意web脚本或者HTML。

CVE-2012-1098 affects n/a n/a. No confirmed in-the-wild exploitation; assess based on exposure. 基于Rails 3.0.12之前的3.0.x版本，3.1.4版本之前的3.1.x版本，与3.2.2之前的3.2.x版本的Ruby中存在跨站脚本漏洞。远程攻击者可利用该漏洞借助涉及通过某些方法操作的SafeBuffer对象的向量，注入任意web脚本或者HTML。 CVE-2012-1098 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2012-1098

I. Basic Information for CVE-2012-1098

Affected Products

II. Public POCs for CVE-2012-1098

III. Intelligence Information for CVE-2012-1098

Mailing List Discussions for CVE-2012-1098 (3)

• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html vendor-advisory x_refsource_FEDORA
• http://www.openwall.com/lists/oss-security/2012/03/02/6 mailing-list x_refsource_MLIST
• http://www.openwall.com/lists/oss-security/2012/03/03/1 mailing-list x_refsource_MLIST

Security Blog Posts for CVE-2012-1098 (1)

• http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released x_refsource_CONFIRM

Other References for CVE-2012-1098 (1)

• http://groups.google.com/group/rubyonrails-security/msg/1c2e01a5e42722c9?dmode=source&output=gplain mailing-list x_refsource_MLIST

• https://www.cve.org/CVERecord?id=CVE-2012-1098

Same Patch Batch · n/a · 2012-03-13 · 26 CVEs total

Showing top 20 of 26 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

V. Comments for CVE-2012-1098