Skip to content

Cross-site Scripting in in JRuby

Moderate severity GitHub Reviewed Published May 2, 2022 to the GitHub Advisory Database • Updated Jan 28, 2023

Package

maven org.jruby:jruby-core (Maven)

Affected versions

< 1.4.1

Patched versions

1.4.1

Description

The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.

References

Published by the National Vulnerability Database Nov 23, 2012
Published to the GitHub Advisory Database May 2, 2022
Reviewed Nov 1, 2022
Last updated Jan 28, 2023

Severity

Moderate

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(61st percentile)

Weaknesses

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Learn more on MITRE.

CVE ID

CVE-2010-1330

GHSA ID

GHSA-wmq2-jc9m-xp4m

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.