CVE-2011-2197
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does…
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
Timeline
ID reserved
By redhat
- 30 days later
· 30 days later
Published
- 13 years later
· 13 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
- EPSS (exploitation in 30 days)
- 2.0% · top 20% of all CVEs (8 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
n/a
- affected n/a
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- RubyGemsactionpackGHSA-v9v4-7jp6-8c73 (opens in a new tab)
- RubyGemsactivesupportGHSA-v9v4-7jp6-8c73 (opens in a new tab)
References (7)
- [rubyonrails-security] 20110607 Potential XSS Vulnerability in Ruby on Rails Applications (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- FEDORA-2011-8494 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- FEDORA-2011-8580 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications (opens in a new tab)x_refsource_CONFIRMx_transferred
- 44789 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- [oss-security] 20110609 CVE Request: Ruby on Rails 3/rails_xss XSS (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20110613 Re: CVE Request: Ruby on Rails 3/rails_xss XSS (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-v9v4-7jp6-8c73 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2011-2197)Record last updated .