oss-sec mailing list archives
Re: CVE Request: rubygem-will_paginate XSS vulnerabilities
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 26 Dec 2013 21:28:31 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/26/2013 12:43 PM, Ratul Gupta wrote:
Hello, https://bugzilla.redhat.com/show_bug.cgi?id=1046642 Cross-Site Scripting (XSS) vulnerabilities were found in will_paginate gem for Ruby, where certain input related to generated pagination links were not properly sanitised before being returned. This could be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Can a CVE please be assigned to this issue?
Please use CVE-2013-6459 for this issue. References: https://bugs.gentoo.org/show_bug.cgi?id=495220 Original Advisory: https://github.com/mislav/will_paginate/releases/tag/v3.0.5 - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iQIcBAEBAgAGBQJSvQHuAAoJEBYNRVNeJnmTBhYQANl9B1XuAA2gf7+0FuchOUmM LGwLqQDTI589E2BtRj6UsWE04Q1TtqvbJMdpjLhoqQsNMzavmrbG/hqGqwWwZ0bd 8SDVWWZ0pOJgD0c22xLdMfrDzDakLxwvDFTgOHLuGrLHS/19i+P/Woza2CKADLny bYnWkw3O4QzsPU1QGPXH6k46jd01IznJPIL+3J8Bb4WNnlVV0FpGJBHhWw8yfDm1 gDTEDH1NFDtlEMPcbsbvNXESo0AOZnBJNLmCWBZAbPcNPtWSNbuPd9wTPCwvVSCR aKnPYSouGnKD8aCPPpIFo4NmnYre3qnb88PHvTje1dC/llR1r5/tnu1Cb0X7cFqn lDjQegFjg74sDesIZXuzkiKUGLgwNaM2pr35CA4r5wZpCYePq61nLTmJE1Ecf28U UjE3uzXY8QNxwQZ1/5i7+tlecMFUFWPYq8udiMtmRNH2NN7ODTM6C2i0cWmdba1y sLtIGley3w9rrFR/gV2oG5EzSPa+OaEfHF+3DGxBQNNb26ssvp8Yogb2KyJGqGMU Jay8SDiLwIIME6tkuTNrioGQZWNtAAGiug+rln80pNEpljJmroTCaHYyw1AEeT82 qPyLRYqoYDcZCHt/R4yeBkP2S/InZRHUlaDWL4Y3EGZlHCj7It3mDRCmlCaDjh9e aPVrjbrbBSS/5mhk204F =y0IJ -----END PGP SIGNATURE-----
Current thread:
- CVE Request: rubygem-will_paginate XSS vulnerabilities Ratul Gupta (Dec 26)
- Re: CVE Request: rubygem-will_paginate XSS vulnerabilities Kurt Seifried (Dec 26)