--- 
gem: activesupport
framework: rails
cve: 2012-1098
osvdb: 79726
url: https://nvd.nist.gov/vuln/detail/CVE-2012-1098
title: Ruby on Rails SafeBuffer Object [] Direct Manipulation XSS
date: 2012-03-01

description: |
  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
  attack. This flaw exists because athe application does not validate direct
  manipulations of SafeBuffer objects via '[]' and other methods. This may
  allow a user to create a specially crafted request that would execute
  arbitrary script code in a user's browser within the trust relationship
  between their browser and the server.

cvss_v2: 4.3

unaffected_versions:
  - "< 3.0.0"

patched_versions: 
  - ~> 3.0.12
  - ~> 3.1.4
  - ">= 3.2.2"