CVE-2015-3226

Published: Jul 26, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.

Affected (31)

Products: Rubyonrails: Rails, Ruby On Rails

Rubyonrails

2 products

Rails

Ruby On Rails

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Rubyonrails Rails	Version 3.0.0
Rubyonrails Rails	Version 3.1.0
Rubyonrails Rails	Version 3.2.0
Rubyonrails Rails	Version 3.2.10
Rubyonrails Rails	Version 3.2.11
Rubyonrails Rails	Version 3.2.12
Rubyonrails Rails	Version 3.2.13
Rubyonrails Rails	Version 3.2.15
Rubyonrails Rails	Version 3.2.16
Rubyonrails Rails	Version 3.2.17
Rubyonrails Rails	Version 3.2.1
Rubyonrails Rails	Version 3.2.2
Rubyonrails Rails	Version 3.2.3
Rubyonrails Rails	Version 3.2.4
Rubyonrails Rails	Version 3.2.5
Rubyonrails Rails	Version 3.2.6
Rubyonrails Rails	Version 3.2.7
Rubyonrails Rails	Version 3.2.8
Rubyonrails Rails	Version 3.2.9
Rubyonrails Rails	Version 4.1.0
Rubyonrails Rails	Version 4.1.1
Rubyonrails Rails	Version 4.1.2
Rubyonrails Rails	Version 4.1.3
Rubyonrails Rails	Version 4.1.4
Rubyonrails Rails	Version 4.1.5
Rubyonrails Rails	Version 4.1.6
Rubyonrails Rails	Version 4.1.7
Rubyonrails Rails	Version 4.1.8
Rubyonrails Rails	Version 4.2.0
Rubyonrails Rails	Version 4.2.1
Rubyonrails Ruby On Rails	Version 3.2.14