Every CVE Search/ Get API key

CVE-2012-3464

activesupport Cross-site Scripting vulnerability

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Exploit likelihood

2.57%Up 1.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Record
CVE-2012-3464
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Record
CVE-2012-3464
Updated
2026-11-02
EUVDEUVD-2017-0249 No score

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Record
EUVD-2017-0249
Updated
2026-11-03
GitHub AdvisoriesGHSA-h835-75hw-pj89 No score

activesupport Cross-site Scripting vulnerability

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 2.3.16, 3.0.x before , 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Record
GHSA-h835-75hw-pj89
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Record
CVE-2012-3464
Updated
2026-11-02
OSVDEBIAN-CVE-2012-3464 No score

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Record
DEBIAN-CVE-2012-3464
Updated
2026-11-02
OSVGHSA-h835-75hw-pj89 No score

activesupport Cross-site Scripting vulnerability

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 2.3.16, 3.0.x before , 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Record
GHSA-h835-75hw-pj89
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
activesupport
RubyGems
 3.1.0 up to 3.1.8
3.1.8
activesupport
RubyGems
 3.2.0 up to 3.2.8
3.2.8
activesupport
RubyGems
 3.0.0.beta up to 3.0.17
3.0.17
activesupport
RubyGems
 before 2.3.16
2.3.16
rails
Debian:12
 before 2.3.14.1
2.3.14.1
rails
Debian:13
 before 2.3.14.1
2.3.14.1
rails
Debian:14
 before 2.3.14.1
2.3.14.1
rails
Debian:6.0
 before 2.3.5-1.2+squeeze8, plus listed versions
2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze3
Show 5 moreShow less
2.3.5-1.2+squeeze42.3.5-1.2+squeeze4.12.3.5-1.2+squeeze52.3.5-1.2+squeeze62.3.5-1.2+squeeze7
2.3.5-1.2+squeeze8
activesupport
RubyGems
 3.0.0.beta up to 3.0.17, plus listed versions
3.0.03.0.0.beta23.0.0.beta33.0.0.beta43.0.0.rc
Show 34 moreShow less
3.0.0.rc23.0.13.0.103.0.10.rc13.0.113.0.123.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.23.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.0.pre
3.0.17
activesupport
RubyGems
 3.1.0 up to 3.1.8, plus listed versions
3.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.2
Show 9 moreShow less
3.1.2.rc13.1.2.rc23.1.33.1.43.1.4.rc13.1.53.1.5.rc13.1.63.1.7
3.1.8
Show 71 moreShow less
Affected packages
PackageAffectedFixed
activesupport
RubyGems
 3.2.0 up to 3.2.8, plus listed versions
3.2.13.2.23.2.2.rc13.2.33.2.3.rc1
Show 9 moreShow less
3.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.8.rc13.2.8.rc2
3.2.8
activesupport
RubyGems
 before 2.3.16, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 40 moreShow less
1.1.01.1.11.2.11.2.21.2.31.2.41.2.51.3.01.3.11.4.01.4.11.4.21.4.31.4.42.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.152.3.22.3.32.3.42.3.52.3.62.3.6.pre2.3.72.3.82.3.8.pre12.3.92.3.9.pre
2.3.16
graphviz
Red Hat:openshift:1::el6
 before 0:2.26.0-10.el6
0:2.26.0-10.el6
graphviz-debuginfo
Red Hat:openshift:1::el6
 before 0:2.26.0-10.el6
0:2.26.0-10.el6
graphviz-devel
Red Hat:openshift:1::el6
 before 0:2.26.0-10.el6
0:2.26.0-10.el6
graphviz-doc
Red Hat:openshift:1::el6
 before 0:2.26.0-10.el6
0:2.26.0-10.el6
graphviz-gd
Red Hat:openshift:1::el6
 before 0:2.26.0-10.el6
0:2.26.0-10.el6
graphviz-ruby
Red Hat:openshift:1::el6
 before 0:2.26.0-10.el6
0:2.26.0-10.el6
openshift-console
Red Hat:openshift:1::el6
 before 0:0.0.16-1.el6op
0:0.0.16-1.el6op
openshift-origin-broker
Red Hat:openshift:1::el6
 before 0:1.0.11-1.el6op
0:1.0.11-1.el6op
openshift-origin-broker-util
Red Hat:openshift:1::el6
 before 0:1.0.15-1.el6op
0:1.0.15-1.el6op
ruby193-ruby
Red Hat:openshift:1::el6
 before 0:1.9.3.327-25.el6
0:1.9.3.327-25.el6
ruby193-ruby-debuginfo
Red Hat:openshift:1::el6
 before 0:1.9.3.327-25.el6
0:1.9.3.327-25.el6
ruby193-ruby-devel
Red Hat:openshift:1::el6
 before 0:1.9.3.327-25.el6
0:1.9.3.327-25.el6
ruby193-ruby-doc
Red Hat:openshift:1::el6
 before 0:1.9.3.327-25.el6
0:1.9.3.327-25.el6
ruby193-ruby-irb
Red Hat:openshift:1::el6
 before 0:1.9.3.327-25.el6
0:1.9.3.327-25.el6
ruby193-ruby-libs
Red Hat:openshift:1::el6
 before 0:1.9.3.327-25.el6
0:1.9.3.327-25.el6
ruby193-ruby-tcltk
Red Hat:openshift:1::el6
 before 0:1.9.3.327-25.el6
0:1.9.3.327-25.el6
ruby193-rubygem-actionpack
Red Hat:openshift:1::el6
 before 1:3.2.8-3.el6
1:3.2.8-3.el6
ruby193-rubygem-actionpack-doc
Red Hat:openshift:1::el6
 before 1:3.2.8-3.el6
1:3.2.8-3.el6
ruby193-rubygem-activemodel
Red Hat:openshift:1::el6
 before 0:3.2.8-2.el6
0:3.2.8-2.el6
ruby193-rubygem-activemodel-doc
Red Hat:openshift:1::el6
 before 0:3.2.8-2.el6
0:3.2.8-2.el6
ruby193-rubygem-activerecord
Red Hat:openshift:1::el6
 before 1:3.2.8-3.el6
1:3.2.8-3.el6
ruby193-rubygem-activerecord-doc
Red Hat:openshift:1::el6
 before 1:3.2.8-3.el6
1:3.2.8-3.el6
ruby193-rubygem-bigdecimal
Red Hat:openshift:1::el6
 before 0:1.1.0-25.el6
0:1.1.0-25.el6
ruby193-rubygem-io-console
Red Hat:openshift:1::el6
 before 0:0.3-25.el6
0:0.3-25.el6
ruby193-rubygem-json
Red Hat:openshift:1::el6
 before 0:1.5.4-25.el6
0:1.5.4-25.el6
ruby193-rubygem-minitest
Red Hat:openshift:1::el6
 before 0:2.5.1-25.el6
0:2.5.1-25.el6
ruby193-rubygem-railties
Red Hat:openshift:1::el6
 before 0:3.2.8-2.el6
0:3.2.8-2.el6
ruby193-rubygem-railties-doc
Red Hat:openshift:1::el6
 before 0:3.2.8-2.el6
0:3.2.8-2.el6
ruby193-rubygem-rake
Red Hat:openshift:1::el6
 before 0:0.9.2.2-25.el6
0:0.9.2.2-25.el6
ruby193-rubygem-rdoc
Red Hat:openshift:1::el6
 before 0:3.9.4-25.el6
0:3.9.4-25.el6
ruby193-rubygem-ruby_parser
Red Hat:openshift:1::el6
 before 0:2.3.1-3.el6op
0:2.3.1-3.el6op
ruby193-rubygem-ruby_parser-doc
Red Hat:openshift:1::el6
 before 0:2.3.1-3.el6op
0:2.3.1-3.el6op
ruby193-rubygems
Red Hat:openshift:1::el6
 before 0:1.8.23-25.el6
0:1.8.23-25.el6
ruby193-rubygems-devel
Red Hat:openshift:1::el6
 before 0:1.8.23-25.el6
0:1.8.23-25.el6
rubygem-actionpack
Red Hat:openshift:1::el6
 before 1:3.0.13-4.el6op
1:3.0.13-4.el6op
rubygem-activemodel
Red Hat:openshift:1::el6
 before 0:3.0.13-3.el6op
0:3.0.13-3.el6op
rubygem-activemodel-doc
Red Hat:openshift:1::el6
 before 0:3.0.13-3.el6op
0:3.0.13-3.el6op
rubygem-activerecord
Red Hat:openshift:1::el6
 before 1:3.0.13-5.el6op
1:3.0.13-5.el6op
rubygem-bson
Red Hat:openshift:1::el6
 before 0:1.8.1-2.el6op
0:1.8.1-2.el6op
rubygem-mongo
Red Hat:openshift:1::el6
 before 0:1.8.1-2.el6op
0:1.8.1-2.el6op
rubygem-mongo-doc
Red Hat:openshift:1::el6
 before 0:1.8.1-2.el6op
0:1.8.1-2.el6op
rubygem-openshift-origin-auth-remote-user
Red Hat:openshift:1::el6
 before 0:1.0.5-1.el6op
0:1.0.5-1.el6op
rubygem-openshift-origin-console
Red Hat:openshift:1::el6
 before 0:1.0.10-1.el6op
0:1.0.10-1.el6op
rubygem-openshift-origin-console-doc
Red Hat:openshift:1::el6
 before 0:1.0.10-1.el6op
0:1.0.10-1.el6op
rubygem-openshift-origin-controller
Red Hat:openshift:1::el6
 before 0:1.0.12-1.el6op
0:1.0.12-1.el6op
rubygem-ruby_parser
Red Hat:openshift:1::el6
 before 0:2.0.4-6.el6op
0:2.0.4-6.el6op
rubygem-ruby_parser-doc
Red Hat:openshift:1::el6
 before 0:2.0.4-6.el6op
0:2.0.4-6.el6op
openshift-origin-cartridge-jbosseap-6.0
Red Hat:openshift:1::el6
 before 0:1.0.4-1.el6op
0:1.0.4-1.el6op
openshift-origin-cartridge-cron-1.4
Red Hat:openshift:1::el6
 before 0:1.0.3-1.el6op
0:1.0.3-1.el6op
openshift-origin-cartridge-diy-0.1
Red Hat:openshift:1::el6
 before 0:1.0.3-1.el6op
0:1.0.3-1.el6op
openshift-origin-cartridge-haproxy-1.4
Red Hat:openshift:1::el6
 before 0:1.0.4-1.el6op
0:1.0.4-1.el6op
openshift-origin-cartridge-jbossews-1.0
Red Hat:openshift:1::el6
 before 0:1.0.13-1.el6op
0:1.0.13-1.el6op
openshift-origin-cartridge-jenkins-1.4
Red Hat:openshift:1::el6
 before 0:1.0.2-1.el6op
0:1.0.2-1.el6op
openshift-origin-cartridge-jenkins-client-1.4
Red Hat:openshift:1::el6
 before 0:1.0.2-1.el6op
0:1.0.2-1.el6op
openshift-origin-cartridge-mysql-5.1
Red Hat:openshift:1::el6
 before 0:1.0.5-1.el6op
0:1.0.5-1.el6op
openshift-origin-cartridge-perl-5.10
Red Hat:openshift:1::el6
 before 0:1.0.3-1.el6op
0:1.0.3-1.el6op
openshift-origin-cartridge-php-5.3
Red Hat:openshift:1::el6
 before 0:1.0.5-1.el6op
0:1.0.5-1.el6op
openshift-origin-cartridge-postgresql-8.4
Red Hat:openshift:1::el6
 before 0:1.0.3-2.el6op
0:1.0.3-2.el6op
openshift-origin-cartridge-ruby-1.8
Red Hat:openshift:1::el6
 before 0:1.0.7-1.el6op
0:1.0.7-1.el6op
openshift-origin-cartridge-ruby-1.9-scl
Red Hat:openshift:1::el6
 before 0:1.0.8-1.el6op
0:1.0.8-1.el6op
openshift-origin-msg-node-mcollective
Red Hat:openshift:1::el6
 before 0:1.0.3-1.el6op
0:1.0.3-1.el6op
php
Red Hat:openshift:1::el6
 before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-bcmath
Red Hat:openshift:1::el6
 before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-debuginfo
Red Hat:openshift:1::el6
 before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-devel
Red Hat:openshift:1::el6
 before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-imap
Red Hat:openshift:1::el6
 before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mbstring
Red Hat:openshift:1::el6
 before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-process
Red Hat:openshift:1::el6
 before 0:5.3.3-22.el6
0:5.3.3-22.el6
rubygem-openshift-origin-node
Red Hat:openshift:1::el6
 before 0:1.0.11-1.el6op
0:1.0.11-1.el6op

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-3464 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published August 10, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.57%, the 85th percentile. Fixed in activesupport 3.1.8.

References

Show 83 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open