Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Ruby on Rails 3: Hackers can inject malicious code into your website

CVE-2012-1098 · published 14 years ago
Summary

A weakness in older versions of Ruby on Rails allows attackers to inject malicious code into your website, potentially stealing user data or taking control of your site. This affects Ruby on Rails versions 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2. To protect your site, update to the latest version of Ruby on Rails.

What to do
  • Update david heinemeier hansson activesupport to version 3.0.12.
  • Update david heinemeier hansson activesupport to version 3.1.4.
  • Update david heinemeier hansson activesupport to version 3.2.2.
Affected software
Ecosystem VendorProductAffected versions
rubygems david heinemeier hansson activesupport >= 3.0.0, < 3.0.12
>= 3.1.0, < 3.1.4
>= 3.2.0, < 3.2.2
Fix: upgrade to 3.0.12
– rubyonrails rails 3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
9 more version ranges
cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*
– rubyonrails ruby_on_rails 3.0.4
cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors ...
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.
References
Severity
4.3 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Mar 2012
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-qv8p-v9qw-wc7g · GHSA
CVE-2012-1098 · NVD
Track software like this
Free during beta