GHSA-pxr8-w3jq-rcwj

rails_admin ruby gem XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-12098

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	rails_admin	< 1.3.0	1.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-12098 advisory
https://github.com/advisories/GHSA-pxr8-w3jq-rcwj advisory
https://github.com/railsadminteam/rails_admin web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_admin/CVE-2017-12098.yml web
https://web.archive.org/web/20210116160904/http://www.securityfocus.com/bid/102486 web
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450 web