CVE-2015-1840
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Exploit likelihood
What each source reports
NVD Score used
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- Record
CVE-2015-1840- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- Record
CVE-2015-1840- Updated
- 2026-11-02
EUVDEUVD-2017-0163 No score
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- Record
EUVD-2017-0163- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4whc-pp4x-9pf3 No score
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- Record
GHSA-4whc-pp4x-9pf3- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- Record
CVE-2015-1840- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1840 No score
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- Record
DEBIAN-CVE-2015-1840- Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-4whc-pp4x-9pf3 No score
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- Record
GHSA-4whc-pp4x-9pf3- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10512-1 No score
ruby2.2-rubygem-jquery-rails-4.2.1-1.1 on GA media
These are all security issues fixed in the ruby2.2-rubygem-jquery-rails-4.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10512-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11334-1 No score
ruby2.7-rubygem-jquery-rails-4.4.0-1.7 on GA media
These are all security issues fixed in the ruby2.7-rubygem-jquery-rails-4.4.0-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11334-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12144-1 No score
ruby3.1-rubygem-jquery-rails-4.5.0-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-jquery-rails-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12144-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13159-1 No score
ruby3.2-rubygem-jquery-rails-4.5.1-1.3 on GA media
These are all security issues fixed in the ruby3.2-rubygem-jquery-rails-4.5.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13159-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14169-1 No score
ruby3.3-rubygem-jquery-rails-4.6.0-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-jquery-rails-4.6.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14169-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15117-1 No score
ruby3.4-rubygem-jquery-rails-4.6.0-1.7 on GA media
These are all security issues fixed in the ruby3.4-rubygem-jquery-rails-4.6.0-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15117-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10350-1 No score
ruby4.0-rubygem-jquery-rails-4.6.0-1.9 on GA media
These are all security issues fixed in the ruby4.0-rubygem-jquery-rails-4.6.0-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10350-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1840 No score
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
- Record
UBUNTU-CVE-2015-1840- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jquery-railsRubyGems |
before 3.1.3 | 3.1.3 |
jquery-railsRubyGems |
4.0.0 up to 4.0.4 | 4.0.4 |
jquery-ujsRubyGems |
before 1.0.4 | 1.0.4 |
ruby-jquery-railsDebian:12 |
before 4.0.4-1 | 4.0.4-1 |
ruby-jquery-railsDebian:13 |
before 4.0.4-1 | 4.0.4-1 |
ruby-jquery-railsDebian:14 |
before 4.0.4-1 | 4.0.4-1 |
jquery-railsRubyGems |
before 3.1.3, plus listed versions 0.1.10.1.20.1.30.20.2.1 Show 45 moreShow less0.2.20.2.30.2.40.2.50.2.60.2.71.01.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.0.rc2.0.12.0.22.0.32.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.3.03.0.03.0.13.0.23.0.33.0.43.1.0 |
3.1.3 |
jquery-railsRubyGems |
4.0.0 up to 4.0.4, plus listed versions 4.0.14.0.24.0.3 |
4.0.4 |
rubygem-jquery-railsopenSUSE:Tumbleweed |
before 4.5.0-1.1 | 4.5.0-1.1 |
ruby3.2-rubygem-jquery-railsopenSUSE:Tumbleweed |
before 4.5.1-1.3 | 4.5.1-1.3 |
rubygem-jquery-railsopenSUSE:Tumbleweed |
before 4.6.0-1.5 | 4.6.0-1.5 |
rubygem-jquery-railsopenSUSE:Tumbleweed |
before 4.6.0-1.7 | 4.6.0-1.7 |
rubygem-jquery-railsopenSUSE:Tumbleweed |
before 4.6.0-1.9 | 4.6.0-1.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1840 is a medium vulnerability (CVSS 5.0) in Rubyonrails Jquery-rails, published July 26, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.49%, the 91st percentile. Fixed in jquery-rails 3.1.3.
References
lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html
lists.opensuse.org/opensuse-updates/2015-07/msg00041.html
openwall.com/lists/oss-security/2015/06/16/15
groups.google.com/forum/message/raw?msg=rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J
securityfocus.com/bid/75239
Show 14 moreShow less
github.com/rails/jquery-ujs/blob/master/CHANGELOG.md
nvd.nist.gov/vuln/detail/CVE-2015-1840
web.archive.org/web/20200228084945/http://www.securityfocus.com/bid/75239
security-tracker.debian.org/tracker/CVE-2015-1840
ubuntu.com/security/CVE-2015-1840
cve.org/CVERecord?id=CVE-2015-1840
suse.com/security/cve/CVE-2015-1840
Left out here: 2 versions. The JSON record has them.