Home > Vulnerability Database > CVE-2013-1855

Mend.io Vulnerability Database

CVE-2013-1855

Good to know:

Date: March 19, 2013

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Language: Ruby

Severity Score

3.7

Related Resources (20)

Url: http://rhn.redhat.com/errata/RHSA-2013-0698.html

Url: http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html

Url: https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Url: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Url: http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released

Url: https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-1855.yml

Url: http://support.apple.com/kb/HT5784

Url: http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html

Url: https://bugzilla.redhat.com/show_bug.cgi?id=921331

Url: https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html

Url: https://access.redhat.com/errata/RHSA-2014:1863

Url: http://rhn.redhat.com/errata/RHSA-2014-1863.html

Url: http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/

Url: https://access.redhat.com/security/cve/CVE-2013-1855

Url: http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html

Url: https://access.redhat.com/errata/RHSA-2013:0698

Url: https://nvd.nist.gov/vuln/detail/CVE-2013-1855

Url: http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html

Url: https://www.mend.io/vulnerability-database/CVE-2013-1855

Severity Score

3.7

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

Top Fix

Upgrade Version

Upgrade to version 2.3.18,3.1.12,3.2.13

Learn More

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2013-1855

Good to know:

Date: March 19, 2013

Language: Ruby

Severity Score

Related Resources (20)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?