Vulnerability Name:

CVE-2013-1855 (CCN-82920)

Assigned:2013-03-18
Published:2013-03-18
Updated:2023-02-13
Summary:Ruby on Rails is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the sanitize_css method in Action Pack to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2013-1855

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2013-0698
Moderate: rubygem-actionpack and ruby193-rubygem-actionpack security update

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2014-1863
Important: Subscription Asset Manager 1.4 security update

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: SA52656
Ruby on Rails Multiple Vulnerabilities

Source: CCN
Type: Apple Web site
About the security content of OS X Mountain Lion v10.8.4 and Security Update 2013-002

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: Ruby on Rails Web Site
Rails 3.2.13, 3.1.12, and 2.3.18 have been released!

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: IBM Security Bulletin 1646819
IBM Security Network Protection can be affected by Cross-Site Scripting and Symbol Denial of Service vulnerabilities in Ruby on Rails (CVE-2013-1854, CVE-2013-1857, CVE-2013-1855)

Source: DEBIAN
Type: DSA-2655
rails -- several vulnerabilities

Source: CCN
Type: BID-58552
Ruby on Rails 'sanitize_css()' Method CVE-2013-1855 Cross Site Scripting Vulnerability

Source: XF
Type: UNKNOWN
rubyonrails-cve20131855-xss(82920)

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Oval Definitions
Definition IDClassTitleLast Modified
oval:org.opensuse.security:def:26181
P
Security update for mozilla-nss (Important)
2021-12-06
oval:org.opensuse.security:def:26117
P
Security update for xen (Important)
2021-09-02
oval:org.opensuse.security:def:26105
P
Security update for MozillaFirefox (Important)
2021-08-17
oval:org.opensuse.security:def:26106
P
Security update for libmspack (Moderate)
2021-08-17
oval:org.opensuse.security:def:20131855
V
CVE-2013-1855
2021-08-15
oval:org.opensuse.security:def:36556
P
rubygem-actionpack-3_2-3.2.12-0.19.1 on GA media (Moderate)
2021-06-08
oval:org.opensuse.security:def:26784
P
mono-core on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:27519
P
nagios on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:26531
P
coolkey on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:26823
P
star on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:26309
P
Security update for haproxy (Important)
2020-12-01
oval:org.opensuse.security:def:27554
P
rubygem-actionpack-3_2 on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:26682
P
cyrus-imapd on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:26837
P
vte on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:26390
P
Security update for ark (Low)
2020-12-01
oval:org.opensuse.security:def:26735
P
libMagickCore1-32bit on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:26881
P
dbus-1 on GA media (Moderate)
2020-12-01
oval:org.opensuse.security:def:26447
P
Security update for pdns (Important)
2020-12-01
oval:org.mitre.oval:def:17839
P
DSA-2655-1 rails - several
2014-06-23
oval:com.ubuntu.artful:def:20131855000
V
CVE-2013-1855 on Ubuntu 17.10 (artful) - medium.
2013-03-19
oval:com.ubuntu.trusty:def:20131855000
V
CVE-2013-1855 on Ubuntu 14.04 LTS (trusty) - medium.
2013-03-19
oval:com.ubuntu.cosmic:def:201318550000000
V
CVE-2013-1855 on Ubuntu 18.10 (cosmic) - medium.
2013-03-19
oval:com.ubuntu.bionic:def:20131855000
V
CVE-2013-1855 on Ubuntu 18.04 LTS (bionic) - medium.
2013-03-19
oval:com.ubuntu.xenial:def:20131855000
V
CVE-2013-1855 on Ubuntu 16.04 LTS (xenial) - medium.
2013-03-19
oval:com.ubuntu.bionic:def:201318550000000
V
CVE-2013-1855 on Ubuntu 18.04 LTS (bionic) - medium.
2013-03-19
oval:com.ubuntu.cosmic:def:20131855000
V
CVE-2013-1855 on Ubuntu 18.10 (cosmic) - medium.
2013-03-19
oval:com.ubuntu.xenial:def:201318550000000
V
CVE-2013-1855 on Ubuntu 16.04 LTS (xenial) - medium.
2013-03-19
oval:com.ubuntu.precise:def:20131855000
V
CVE-2013-1855 on Ubuntu 12.04 LTS (precise) - medium.
2013-03-19
BACK