CVE-2011-2197

Published: Jun 30, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.

Affected (47)

Products: Rubyonrails: Rails, Ruby On Rails

Rubyonrails

2 products

Rails

Ruby On Rails

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Rubyonrails Rails	Version 2.0.0
Rubyonrails Rails	Version 2.0.0 rc1
Rubyonrails Rails	Version 2.0.0 rc2
Rubyonrails Rails	Version 2.0.1
Rubyonrails Rails	Version 2.0.2
Rubyonrails Rails	Version 2.0.4
Rubyonrails Rails	Version 2.1.0
Rubyonrails Rails	Version 2.1.1
Rubyonrails Rails	Version 2.1.2
Rubyonrails Rails	Version 2.2.0
Rubyonrails Rails	Version 2.2.1
Rubyonrails Rails	Version 2.2.2
Rubyonrails Rails	Version 2.3.10
Rubyonrails Rails	Version 2.3.11
Rubyonrails Rails	Version 2.3.2
Rubyonrails Rails	Version 2.3.3
Rubyonrails Rails	Version 2.3.4
Rubyonrails Rails	Version 2.3.9

Configuration B

26 vulnerable

Vulnerable Software	Affected Versions
Rubyonrails Rails	Version 3.0.0
Rubyonrails Rails	Version 3.0.0 beta2
Rubyonrails Rails	Version 3.0.0 beta3
Rubyonrails Rails	Version 3.0.0 beta4
Rubyonrails Rails	Version 3.0.0 beta
Rubyonrails Rails	Version 3.0.0 rc2
Rubyonrails Rails	Version 3.0.0 rc
Rubyonrails Rails	Version 3.0.1
Rubyonrails Rails	Version 3.0.1 pre
Rubyonrails Rails	Version 3.0.2
Rubyonrails Rails	Version 3.0.2 pre
Rubyonrails Rails	Version 3.0.3
Rubyonrails Rails	Version 3.0.4 rc1
Rubyonrails Rails	Version 3.0.5
Rubyonrails Rails	Version 3.0.5 rc1
Rubyonrails Rails	Version 3.0.6
Rubyonrails Rails	Version 3.0.6 rc1
Rubyonrails Rails	Version 3.0.6 rc2
Rubyonrails Rails	Version 3.0.7
Rubyonrails Rails	Version 3.0.7 rc1
Rubyonrails Rails	Version 3.0.7 rc2
Rubyonrails Rails	Version 3.0.8 rc1
Rubyonrails Rails	Version 3.0.8 rc2
Rubyonrails Rails	Version 3.0.8 rc3
Rubyonrails Rails	Version 3.0.8 rc4
Rubyonrails Ruby On Rails	Version 3.0.4