Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because input passed via the prompt value is not properly sanitized by the select_tag helper method before returning it to the user. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Upgrade to version 3.0.17, 3.1.8 or 3.2.8 or higher, as it has been reported to fix this vulnerability. In addition, the vendor has released a patch for some older versions.

• Security Tracker: 1027366
• CVE ID: 2012-3463 (see also: NVD)
• Secunia Advisory ID: 50128 51472 51795
• Bugtraq ID: 54959
• Related OSVDB ID: 84513 84516
• Vendor Specific News/Changelog Entry: http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
• Vendor Specific Advisory URL: https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/fV3QUToSMSw[1-25]
• Other Advisory URL: https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain
• RedHat RHSA: RHSA-2012-1542 RHSA-2013:0154

• Not Available