CVE-2011-2932

activesupport Cross-site Scripting vulnerability

4.3 MediumFix available

CVE-2011-2932 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published August 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. Fixed in activesupport 2.3.13.

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."

Exploit likelihood

2.49%Down 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2011-2932
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-2932
Updated: 2026-11-02

EUVDEUVD-2017-0203 No score

Record: EUVD-2017-0203
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9fh3-vh3h-q4g3 No score

activesupport Cross-site Scripting vulnerability

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."

Record: GHSA-9fh3-vh3h-q4g3
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2011-2932
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-2932 No score

Record: DEBIAN-CVE-2011-2932
Updated: 2026-11-02

OSVGHSA-9fh3-vh3h-q4g3 No score

activesupport Cross-site Scripting vulnerability

Record: GHSA-9fh3-vh3h-q4g3
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`activesupport` RubyGems	2.0.0 up to 2.3.13	2.3.13
`activesupport` RubyGems	3.0.0 up to 3.0.10	3.0.10
`rails` Debian:12	before 2.3.14	2.3.14
`rails` Debian:13	before 2.3.14	2.3.14
`rails` Debian:14	before 2.3.14	2.3.14
`rails` Debian:6.0	before 2.3.5-1.2+squeeze8, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze3 Show 5 moreShow less 2.3.5-1.2+squeeze42.3.5-1.2+squeeze4.12.3.5-1.2+squeeze52.3.5-1.2+squeeze62.3.5-1.2+squeeze7	2.3.5-1.2+squeeze8
`activesupport` RubyGems	2.0.0 up to 2.3.13, plus listed versions 2.0.12.0.22.0.42.0.52.1.0 Show 18 moreShow less 2.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.22.3.32.3.42.3.52.3.62.3.6.pre2.3.72.3.82.3.8.pre12.3.92.3.9.pre	2.3.13
`activesupport` RubyGems	3.0.0 up to 3.0.10, plus listed versions 3.0.13.0.10.rc13.0.23.0.33.0.4 Show 18 moreShow less 3.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc5	3.0.10

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 13 moreShow less