CVE-2017-12098

Description

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victims browser. An attacker can phish an authenticated user to trigger this vulnerability.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.397

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-12098 are fixed in Ruby-rails_admin 1.3.0	Windows
Vulnerabilities CVE-2017-12098 are fixed in Ruby-rails_admin for Linux 1.3.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234