Deskripsi CVE

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

Informasi CVE

Kelemahan Terkait

CWE-ID	Nama Kelemahan	Sumber
CWE-79	Improper Neutralization of Input During Web Page Generation The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Metrik

Metrik	Skor	Tingkat keparahan	CVSS Vektor	Sumber
V2	4.3		AV:N/AC:M/Au:N/C:N/I:P/A:N	nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

EPSS First.org

Produk yang Disebutkan

Konfigurasi 0

Rubyonrails>>Rails >> Version 2.3.2

Rubyonrails>>Rails >> Version 2.3.3

Rubyonrails>>Rails >> Version 2.3.4

Konfigurasi 0

Rubyonrails>>Rails >> Version 0.9.1

Rubyonrails>>Rails >> Version 0.9.2

Rubyonrails>>Rails >> Version 0.9.3

Rubyonrails>>Rails >> Version 0.9.4

Rubyonrails>>Rails >> Version 0.9.4.1

Rubyonrails>>Rails >> Version 0.10.0

Rubyonrails>>Rails >> Version 0.10.1

Rubyonrails>>Rails >> Version 0.11.0

Rubyonrails>>Rails >> Version 0.11.1

Rubyonrails>>Rails >> Version 0.12.0

Rubyonrails>>Rails >> Version 0.12.1

Rubyonrails>>Rails >> Version 0.13.0

Rubyonrails>>Rails >> Version 0.13.1

Rubyonrails>>Rails >> Version 0.14.1

Rubyonrails>>Rails >> Version 0.14.2

Rubyonrails>>Rails >> Version 0.14.3

Rubyonrails>>Rails >> Version 0.14.4

Rubyonrails>>Rails >> Version 1.0.0

Rubyonrails>>Rails >> Version 1.1.0

Rubyonrails>>Rails >> Version 1.1.1

Rubyonrails>>Rails >> Version 1.1.2

Rubyonrails>>Rails >> Version 1.1.3

Rubyonrails>>Rails >> Version 1.1.4

Rubyonrails>>Rails >> Version 1.1.5

Rubyonrails>>Rails >> Version 1.1.6

Rubyonrails>>Rails >> Version 1.2.0

Rubyonrails>>Rails >> Version 1.2.1

Rubyonrails>>Rails >> Version 1.2.2

Rubyonrails>>Rails >> Version 1.2.3

Rubyonrails>>Rails >> Version 1.2.4

Rubyonrails>>Rails >> Version 1.2.5

Rubyonrails>>Rails >> Version 1.2.6

Rubyonrails>>Rails >> Version 1.9.5

Rubyonrails>>Rails >> Version 2.0.0

Rubyonrails>>Rails >> Version 2.0.1

Rubyonrails>>Rails >> Version 2.0.2

Rubyonrails>>Rails >> Version 2.0.4

Rubyonrails>>Rails >> Version 2.1.0

Rubyonrails>>Rails >> Version 2.1.1

Rubyonrails>>Ruby_on_rails >> Version Hingga (termasuk) 2.1.2

Rubyonrails>>Ruby_on_rails >> Version 0.5.0

Rubyonrails>>Ruby_on_rails >> Version 0.5.5

Rubyonrails>>Ruby_on_rails >> Version 0.5.6

Rubyonrails>>Ruby_on_rails >> Version 0.5.7

Rubyonrails>>Ruby_on_rails >> Version 0.6.0

Rubyonrails>>Ruby_on_rails >> Version 0.6.5

Rubyonrails>>Ruby_on_rails >> Version 0.7.0

Rubyonrails>>Ruby_on_rails >> Version 0.8.0

Rubyonrails>>Ruby_on_rails >> Version 0.8.5

Rubyonrails>>Ruby_on_rails >> Version 0.9.0

Referensi

http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1
Tags : mailing-list, x_refsource_MLIST

http://secunia.com/advisories/37446
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.vupen.com/english/advisories/2009/3352
Tags : vdb-entry, x_refsource_VUPEN

http://www.debian.org/security/2011/dsa-2301
Tags : vendor-advisory, x_refsource_DEBIAN

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
Tags : vendor-advisory, x_refsource_APPLE

http://weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-released
Tags : x_refsource_CONFIRM

http://www.securityfocus.com/bid/37142
Tags : vdb-entry, x_refsource_BID

http://www.debian.org/security/2011/dsa-2260
Tags : vendor-advisory, x_refsource_DEBIAN

http://www.openwall.com/lists/oss-security/2009/11/27/2
Tags : mailing-list, x_refsource_MLIST

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
Tags : vendor-advisory, x_refsource_SUSE

http://support.apple.com/kb/HT4077
Tags : x_refsource_CONFIRM

http://www.securitytracker.com/id?1023245
Tags : vdb-entry, x_refsource_SECTRACK

http://secunia.com/advisories/38915
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.openwall.com/lists/oss-security/2009/12/08/3
Tags : mailing-list, x_refsource_MLIST

http://github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5
Tags : x_refsource_CONFIRM

Tanggal	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	3.41%	–	–
2022-02-20	–	–	3.41%	–	–
2022-04-03	–	–	3.41%	–	–
2022-06-26	–	–	3.41%	–	–
2023-02-26	–	–	3.41%	–	–
2023-03-12	–	–	–	0.32%	–
2023-07-23	–	–	–	0.32%	–
2024-02-04	–	–	–	0.32%	–
2024-02-11	–	–	–	0.32%	–
2024-06-02	–	–	–	0.32%	–
2024-06-02	–	–	–	0.32%	–
2024-06-08	–	–	–	0.32%	–
2024-12-22	–	–	–	0.35%	–
2025-01-19	–	–	–	0.35%	–
2025-03-18	–	–	–	–	1.63%
2025-03-30	–	–	–	–	1.63%
2025-04-15	–	–	–	–	1.63%
2025-11-18	–	–	–	–	1.63%
2025-11-21	–	–	–	–	1.63%
2026-01-01	–	–	–	–	1.63%
2026-01-04	–	–	–	–	1.63%
2026-01-23	–	–	–	–	1.63%

Tanggal	Persentil
2022-02-06	66%
2022-02-20	67%
2022-04-03	83%
2022-06-26	84%
2023-02-26	85%
2023-03-12	66%
2023-07-23	67%
2024-02-04	68%
2024-02-11	7%
2024-06-02	7%
2024-06-02	7%
2024-06-08	71%
2024-12-22	72%
2025-01-19	72%
2025-03-18	81%
2025-03-30	8%
2025-04-15	81%
2025-11-18	8%
2025-11-21	81%
2026-01-01	82%
2026-01-04	81%
2026-01-23	82%

CVE-2009-4214 : Detail

CVE-2009-4214

Deskripsi CVE

Informasi CVE

Kelemahan Terkait

Metrik

EPSS

Skor EPSS

Persentil EPSS

Produk yang Disebutkan

Konfigurasi 0

Konfigurasi 0

Referensi