Source: ruby-rails-admin Version: 0.8.1+dfsg-3 Severity: grave Tags: patch security upstream Justification: user security hole Forwarded: https://github.com/sferik/rails_admin/issues/2985
Hi, The following vulnerability was published for ruby-rails-admin. CVE-2017-12098[0]: | An exploitable cross site scripting (XSS) vulnerability exists in the | add filter functionality of the rails_admin rails gem version 1.2.0. A | specially crafted URL can cause an XSS flaw resulting in an attacker | being able to execute arbitrary javascript on the victim's browser. An | attacker can phish an authenticated user to trigger this | vulnerability. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-12098 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12098 [1] https://github.com/sferik/rails_admin/issues/2985 [2] https://github.com/sferik/rails_admin/commit/44f09ed72b5e0e917a5d61bd89c48d97c494b41c Regards, Salvatore
