Vulnerability Details : CVE-2013-1855
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2013-1855
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:3.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.15:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.16:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*
Threat overview for CVE-2013-1855
Top countries where our scanners detected CVE-2013-1855
Top open port discovered on systems with this issue
53
IPs affected by CVE-2013-1855 3,666
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2013-1855!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2013-1855
0.41%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-1855
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2013-1855
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-1855
-
http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html
openSUSE-SU-2013:0662-1: moderate: update for rubygem-actionpack-2_3
-
http://support.apple.com/kb/HT5784
About the security content of OS X Mountain Lion v10.8.4 and Security Update 2013-002 - Apple Support
-
https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain
Google Groepen
-
http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html
openSUSE-SU-2013:0661-1: moderate: update for rubygem-actionpack-3_2
-
http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
Apple - Lists.apple.com
-
http://rhn.redhat.com/errata/RHSA-2013-0698.html
RHSA-2013:0698 - Security Advisory - Red Hat Customer Portal
-
http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
[SEC] [ANN] Rails 3.2.13, 3.1.12, and 2.3.18 have been released! | Riding Rails
-
http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
openSUSE-SU-2014:0019-1: moderate: update for rubygem-actionpack-2_3
-
http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
Apple - Lists.apple.com
-
http://rhn.redhat.com/errata/RHSA-2014-1863.html
RHSA-2014:1863 - Security Advisory - Red Hat Customer Portal
Jump to