CVE-2011-0446
Rails actionpack gem vulnerable to Cross-site Scripting
CVE-2011-0446 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published February 14, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in actionpack 2.3.11.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 2.35%EPSS, 83rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.11actionpack +10 more
Description
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems | before 2.3.11 | 2.3.11 |
actionpackRubyGems | 3.0.0 up to 3.0.4 | 3.0.4 |
actionviewRubyGems | before 2.3.11 | 2.3.11 |
actionviewRubyGems | 3.0.0 up to 3.0.4 | 3.0.4 |
railsDebian:12 | before 2.3.11-0.1 | 2.3.11-0.1 |
railsDebian:13 | before 2.3.11-0.1 | 2.3.11-0.1 |
railsDebian:14 | before 2.3.11-0.1 | 2.3.11-0.1 |
railsDebian:6.0 From an advisory covering 2 CVEs | before 2.3.5-1.2+squeeze0.1, plus listed versions 2.3.5-1.2 | 2.3.5-1.2+squeeze0.1 |
railsDebian:5.0 From an advisory covering 2 CVEs | before 2.1.0-7+lenny0.1, plus listed versions 2.1.0-62.1.0-7 | 2.1.0-7+lenny0.1 |
actionpackRubyGems | before 2.3.11, plus listed versions 0.9.00.9.51.0.01.0.11.1.0 Show 45 moreShow less1.10.11.10.21.11.01.11.11.11.21.12.01.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.21.13.31.13.41.13.51.13.61.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.22.3.32.3.42.3.5 | 2.3.11 |
actionpackRubyGems | 3.0.0 up to 3.0.4, plus listed versions 3.0.13.0.23.0.33.0.4.rc1 | 3.0.4 |
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
CVE-2011-0446- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
CVE-2011-0446- Updated
- 2026-11-02
EUVDEUVD-2017-0182No score
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
EUVD-2017-0182- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-75w6-p6mg-vh8jNo score
Rails actionpack gem vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
GHSA-75w6-p6mg-vh8j- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
CVE-2011-0446- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-0446No score
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
DEBIAN-CVE-2011-0446- Updated
- 2026-11-02
OSVGHSA-75w6-p6mg-vh8jNo score
Rails actionpack gem vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
GHSA-75w6-p6mg-vh8j- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
vupen.com/english/advisories/2011/0587
lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
securityfocus.com/bid/46291
debian.org/security/2011/dsa-2247
secunia.com/advisories/43274
Show 18 moreShow less
securitytracker.com/id?1025064
groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain
nvd.nist.gov/vuln/detail/CVE-2011-0446
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml
web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
security-tracker.debian.org/tracker/CVE-2011-0446
Left out here: 6 versions. The JSON record has them.