CVE-2009-3009

Published: Sep 8, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

Affected (14)

Products: Rubyonrails: Rails

1 product

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Rubyonrails Rails	Version 2.0.0
Rubyonrails Rails	Version 2.0.0 rc1
Rubyonrails Rails	Version 2.0.0 rc2
Rubyonrails Rails	Version 2.0.1
Rubyonrails Rails	Version 2.0.2
Rubyonrails Rails	Version 2.0.4
Rubyonrails Rails	Version 2.1.0
Rubyonrails Rails	Version 2.1.1
Rubyonrails Rails	Version 2.1.2
Rubyonrails Rails	Version 2.2.0
Rubyonrails Rails	Version 2.2.1
Rubyonrails Rails	Version 2.2.2
Rubyonrails Rails	Version 2.3.2
Rubyonrails Rails	Version 2.3.3

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (28)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063

Source: cve@mitre.org

http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source

Source: cve@mitre.org

Patch

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html

Source: cve@mitre.org

http://secunia.com/advisories/36600

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36717

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1022824

Source: cve@mitre.org

Patch

http://support.apple.com/kb/HT4077

Source: cve@mitre.org

http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1887

Source: cve@mitre.org

http://www.osvdb.org/57666

Source: cve@mitre.org

http://www.securityfocus.com/bid/36278

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/2544

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/53036

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063

Source: af854a3a-2127-422b-91ae-364da2661108

http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/36600

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/36717

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securitytracker.com/id?1022824

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://support.apple.com/kb/HT4077

Source: af854a3a-2127-422b-91ae-364da2661108

http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1887

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/57666

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/36278

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/2544

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/53036

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.