Vulnerability Name:

CVE-2017-1002201 (CCN-170654)

Assigned:2017-05-08
Published:2017-05-08
Updated:2022-04-05
Summary:In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2017-1002201

Source: XF
Type: UNKNOWN
hamlgem-cve20171002201-xss(170654)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20191110 [SECURITY] [DLA 1986-1] ruby-haml security update

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20211229 [SECURITY] [DLA 2864-1] ruby-haml security update

Source: CCN
Type: RubyGems Web site
haml gem for Ruby

Source: GENTOO
Type: Third Party Advisory
GLSA-202007-27

Source: CCN
Type: SNYK-RUBY-HAML-20362
Cross-site Scripting (XSS)

Source: CONFIRM
Type: Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-RUBY-HAML-20362

Vulnerable Configuration:Configuration 1:
  • cpe:/a:haml:haml:*:*:*:*:*:ruby:*:* (Version < 5.0.0)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20171002201
    V
    		CVE-2017-1002201
    2022-05-22
    oval:org.opensuse.security:def:59580
    P
    		Security update for log4j (Important)
    2021-12-17
    oval:org.opensuse.security:def:59576
    P
    		Security update for MozillaFirefox (Important)
    2021-12-12
    oval:org.opensuse.security:def:59830
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:58050
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-11-23
    oval:org.opensuse.security:def:61095
    P
    		Security update for the Linux Kernel (Important)
    2021-10-12
    oval:org.opensuse.security:def:60370
    P
    		Security update for the Linux Kernel (Important)
    2021-09-23
    oval:org.opensuse.security:def:57509
    P
    		Security update for xen (Important)
    2021-09-23
    oval:org.opensuse.security:def:61687
    P
    		zoo-2.10-1.29 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61686
    P
    		yubikey-manager-2.1.0-1.10 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:57994
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-08-25
    oval:org.opensuse.security:def:57491
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-08-20
    oval:org.opensuse.security:def:60329
    P
    		Security update for MozillaFirefox (Important)
    2021-08-17
    oval:org.opensuse.security:def:63348
    P
    		libshibsp-lite8-3.1.0-1.30 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63440
    P
    		libunwind-32bit-1.2.1-2.13 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63490
    P
    		libpcap1-32bit-1.9.1-1.33 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62351
    P
    		wpa_supplicant-2.9-4.29.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63018
    P
    		jython-2.2.1-11.65 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62155
    P
    		libhogweed4-3.4.1-4.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:57064
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:57976
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-07-27
    oval:org.opensuse.security:def:57046
    P
    		Security update for systemd (Important)
    2021-07-21
    oval:org.opensuse.security:def:59763
    P
    		Security update for arpwatch (Important)
    2021-06-28
    oval:org.opensuse.security:def:63524
    P
    		MozillaThunderbird-52.8-1.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:57902
    P
    		Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:57884
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:60488
    P
    		Security update for ovmf (Moderate)
    2021-03-30
    oval:org.opensuse.security:def:58106
    P
    		Security update for nghttp2 (Important)
    2021-03-24
    oval:org.opensuse.security:def:58088
    P
    		Security update for MozillaFirefox (Important)
    2021-03-01
    oval:org.opensuse.security:def:60455
    P
    		Security update for ImageMagick (Moderate)
    2021-02-19
    oval:org.opensuse.security:def:59848
    P
    		Security update for bind (Important)
    2021-02-18
    oval:org.opensuse.security:def:58068
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP3) (Important)
    2021-02-10
    oval:org.opensuse.security:def:60155
    P
    		Security update for curl (Moderate)
    2020-12-10
    oval:org.opensuse.security:def:61710
    P
    		bzip2-1.0.6-5.9.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62697
    P
    		libsmi-devel-0.4.8-1.29 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63252
    P
    		apache2-mod_jk-1.2.43-6.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61881
    P
    		libsndfile-devel-1.0.28-5.5.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62483
    P
    		perl-CGI-4.38-1.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63149
    P
    		dpdk-17.11.2-1.27 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63387
    P
    		apache-commons-beanutils-1.9.2-2.46 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:57794
    P
    		libfreetype6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60883
    P
    		Security update for python-SQLAlchemy (Important)
    2020-12-01
    oval:org.opensuse.security:def:59394
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:60707
    P
    		Security update for adns (Important)
    2020-12-01
    oval:org.opensuse.security:def:59231
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:60827
    P
    		Security update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-networking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-pumavenv-openstack-swift (Important)
    2020-12-01
    oval:org.opensuse.security:def:59412
    P
    		Security update to ucode-intel (Important)
    2020-12-01
    oval:org.opensuse.security:def:58137
    P
    		Security update for ucode-intel (Important)
    2020-12-01
    oval:org.opensuse.security:def:59169
    P
    		Security update for qemu (Important)
    2020-12-01
    oval:org.opensuse.security:def:58169
    P
    		Security update for java-1_8_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:56664
    P
    		Security update for libwpd (Important)
    2020-12-01
    oval:org.opensuse.security:def:59966
    P
    		Security update for nfs-utils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56645
    P
    		Security update for lcms2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60848
    P
    		Security update for crowbar, crowbar-core, crowbar-ha, crowbar-init, crowbar-openstack, crowbar-ui (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60573
    P
    		xinetd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56808
    P
    		Security update for sysstat (Low)
    2020-12-01
    oval:org.opensuse.security:def:61065
    P
    		Security update for kernel-firmware (Important)
    2020-12-01
    oval:org.opensuse.security:def:60792
    P
    		Security update for java-1_7_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:59393
    P
    		Security update for ucode-intel (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57325
    P
    		Security update for finch
    2020-12-01
    oval:org.opensuse.security:def:60669
    P
    		Security update for git (Important)
    2020-12-01
    oval:org.opensuse.security:def:60912
    P
    		Security update for rubygem-haml (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60748
    P
    		Security update for grub2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:59254
    P
    		Security update for mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:58187
    P
    		Security update for nfs-utils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59147
    P
    		Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60136
    P
    		Security update for java-1_8_0-ibm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56663
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60750
    P
    		Security update for xorg-x11-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:58193
    P
    		Security update for rubygem-haml (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56826
    P
    		Security update for libcroco (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56668
    P
    		Security update for rpm (Important)
    2020-12-01
    oval:org.opensuse.security:def:60070
    P
    		Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60972
    P
    		Security update for adns (Important)
    2020-12-01
    oval:org.opensuse.security:def:57343
    P
    		Security update for flash-player
    2020-12-01
    oval:org.opensuse.security:def:60754
    P
    		Security update for java-1_8_0-ibm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57219
    P
    		Security update for glibc
    2020-12-01
    oval:org.opensuse.security:def:60585
    P
    		Security update for slf4j (Important)
    2020-12-01
    oval:org.opensuse.security:def:60833
    P
    		Security update for tomcat (Important)
    2020-12-01
    oval:org.opensuse.security:def:59416
    P
    		Security update for openssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57776
    P
    		libXv1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60798
    P
    		Security update for krb5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59232
    P
    		Security update for ruby2.1 (Important)
    2020-12-01
    oval:org.opensuse.security:def:59146
    P
    		Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60015
    P
    		Security update for texlive (Important)
    2020-12-01
    oval:org.opensuse.security:def:59665
    P
    		Security update for grub2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:58211
    P
    		Security update for caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, crowbar-ui, etcd, flannel, galera-3, mariadb, mariadb-connector-c, openstack-dashboard-theme-SUSE, openstack-heat-templates, openstack-neutron, openstack-nova, openstack-quickstart, patterns-cloud, python-oslo.messaging, python-oslo.utils, python-pysaml2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59327
    P
    		Security update for gcc10 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60630
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:58119
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:56686
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56646
    P
    		Security update for qemu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59881
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:60934
    P
    		Security update for rubygem-loofah (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57237
    P
    		Security update for MySQL
    2020-12-01
    oval:org.opensuse.security:def:60670
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:61015
    P
    		Security update for samba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:84562
    P
    		Security update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-networking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-pumavenv-openstack-swift (Important)
    2020-03-11
    oval:org.opensuse.security:def:84107
    P
    		Security update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-networking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-pumavenv-openstack-swift (Important)
    2020-03-11
    oval:org.opensuse.security:def:80846
    P
    		Security update for caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, crowbar-ui, etcd, flannel, galera-3, mariadb, mariadb-connector-c, openstack-dashboard-theme-SUSE, openstack-heat-templates, openstack-neutron, openstack-nova, openstack-quickstart, patterns-cloud, python-oslo.messaging, python-oslo.utils, python-pysaml2 (Moderate)
    2019-12-11
    oval:org.opensuse.security:def:84365
    P
    		Security update for rubygem-haml (Moderate)
    2019-11-08
    oval:org.opensuse.security:def:80828
    P
    		Security update for rubygem-haml (Moderate)
    2019-11-08
    oval:org.opensuse.security:def:88295
    P
    		Security update for rubygem-haml (Moderate)
    2019-11-08
    oval:com.ubuntu.disco:def:201710022010000000
    V
    		CVE-2017-1002201 on Ubuntu 19.04 (disco) - medium.
    2019-10-15
    oval:com.ubuntu.bionic:def:201710022010000000
    V
    		CVE-2017-1002201 on Ubuntu 18.04 LTS (bionic) - medium.
    2019-10-15
    oval:com.ubuntu.xenial:def:201710022010000000
    V
    		CVE-2017-1002201 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-10-15
    BACK
    haml haml *
    debian debian linux 8.0
    debian debian linux 9.0