CVE-2011-2932
activesupport Cross-site Scripting vulnerability
CVE-2011-2932 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published August 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. Fixed in activesupport 2.3.13.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 2.49%EPSS, 84th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.13activesupport +7 more
Description
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activesupportRubyGems | 2.0.0 up to 2.3.13 | 2.3.13 |
activesupportRubyGems | 3.0.0 up to 3.0.10 | 3.0.10 |
railsDebian:12 | before 2.3.14 | 2.3.14 |
railsDebian:13 | before 2.3.14 | 2.3.14 |
railsDebian:14 | before 2.3.14 | 2.3.14 |
railsDebian:6.0 From an advisory covering 6 CVEs | before 2.3.5-1.2+squeeze8, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze3 Show 5 moreShow less2.3.5-1.2+squeeze42.3.5-1.2+squeeze4.12.3.5-1.2+squeeze52.3.5-1.2+squeeze62.3.5-1.2+squeeze7 | 2.3.5-1.2+squeeze8 |
activesupportRubyGems | 2.0.0 up to 2.3.13, plus listed versions 2.0.12.0.22.0.42.0.52.1.0 Show 18 moreShow less2.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.22.3.32.3.42.3.52.3.62.3.6.pre2.3.72.3.82.3.8.pre12.3.92.3.9.pre | 2.3.13 |
activesupportRubyGems | 3.0.0 up to 3.0.10, plus listed versions 3.0.13.0.10.rc13.0.23.0.33.0.4 Show 18 moreShow less3.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc5 | 3.0.10 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
- Record
CVE-2011-2932- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
- Record
CVE-2011-2932- Updated
- 2026-11-02
EUVDEUVD-2017-0203No score
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
- Record
EUVD-2017-0203- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9fh3-vh3h-q4g3No score
activesupport Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
- Record
GHSA-9fh3-vh3h-q4g3- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
- Record
CVE-2011-2932- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2932No score
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
- Record
DEBIAN-CVE-2011-2932- Updated
- 2026-11-02
OSVGHSA-9fh3-vh3h-q4g3No score
activesupport Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
- Record
GHSA-9fh3-vh3h-q4g3- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugzilla.redhat.com/show_bug.cgi?id=731435
secunia.com/advisories/45917
openwall.com/lists/oss-security/2011/08/17/1
lists.fedoraproject.org/pipermail/package-announce/2011-September/065114.html
Show 13 moreShow less
github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd
groups.google.com/group/rubyonrails-security/msg/f1d2749773db9f21?dmode=source&output=gplain
weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
nvd.nist.gov/vuln/detail/CVE-2011-2932
security-tracker.debian.org/tracker/CVE-2011-2932