{"id":"CVE-2015-1840","aliases":["DEBIAN-CVE-2015-1840","EUVD-2017-0163","GHSA-4whc-pp4x-9pf3","UBUNTU-CVE-2015-1840","openSUSE-SU-2024:10512-1","openSUSE-SU-2024:11334-1","openSUSE-SU-2024:12144-1","openSUSE-SU-2024:13159-1","openSUSE-SU-2024:14169-1","openSUSE-SU-2025:15117-1","openSUSE-SU-2026:10350-1"],"status":"published","title":"jquery-rails and jquery-ujs subject to Exposure of Sensitive Information","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04487,"percentile":0.91535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-07-26T22:00:00Z","modified":"2026-09-09T06:47:20Z","fixes":[{"ecosystem":"RubyGems","package":"jquery-rails","fixed_in":["3.1.3","4.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"jquery-ujs","fixed_in":["1.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-jquery-rails","fixed_in":["4.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-jquery-rails","fixed_in":["4.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-jquery-rails","fixed_in":["4.0.4-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-jquery-rails","fixed_in":["4.5.0-1.1","4.6.0-1.5","4.6.0-1.7","4.6.0-1.9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-jquery-rails","fixed_in":["4.5.1-1.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"jquery-ujs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3"}]}],"versions":["0.1.1","0.1.2","0.1.3","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.0.rc","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.2.2","2.3.0","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2"]},{"source":"osv","ecosystem":"RubyGems","package":"jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3"]},{"source":"osv","ecosystem":"RubyGems","package":"jquery-ujs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-1.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-1.7"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-1.9"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"rubyonrails","product":"jquery-rails"},{"vendor":"rubyonrails","product":"jquery-ujs"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00041.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://openwall.com/lists/oss-security/2015/06/16/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Vendor Advisory","advisory","evidence","web"]},{"url":"http://www.securityfocus.com/bid/75239","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1840","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4whc-pp4x-9pf3","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ujs/CVE-2015-1840.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY","tags":["web"]},{"url":"https://web.archive.org/web/20200228084945/http://www.securityfocus.com/bid/75239","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2015-1840.yml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1840","tags":["advisory"]},{"url":"https://github.com/rails/jquery-rails","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2015-1840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1840","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1840","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P3ES62D53ZVJLXLNPPF5WUL3CWHPQKJT/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-1840","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","status":"published","published":"2015-07-26T22:00:00Z","modified":"2024-08-06T04:54:16.349Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2017-0163","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","status":"published","published":"2015-07-26T22:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:13.664628Z"}],"ghsa":[{"id":"GHSA-4whc-pp4x-9pf3","title":"jquery-rails and jquery-ujs subject to Exposure of Sensitive Information","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2026-01-14T21:44:17Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:17.333958Z"}],"nvd":[{"id":"CVE-2015-1840","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","status":"published","published":"2015-07-26T22:59:00.07Z","modified":"2026-06-17T00:23:05.78Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"CVE-2015-1840","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","status":"published","published":"2015-07-26T22:59:00Z","modified":"2026-03-16T03:04:30.514128Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-1840","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","status":"published","published":"2015-07-26T22:59:00.07Z","modified":"2026-09-09T06:47:20.318532563Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-4whc-pp4x-9pf3","title":"jquery-rails and jquery-ujs subject to Exposure of Sensitive Information","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2026-02-03T02:56:25.062596Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"openSUSE-SU-2024:10512-1","title":"ruby2.2-rubygem-jquery-rails-4.2.1-1.1 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-jquery-rails-4.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:03:17.421516Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11334-1","title":"ruby2.7-rubygem-jquery-rails-4.4.0-1.7 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-jquery-rails-4.4.0-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:06.851348Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:12144-1","title":"ruby3.1-rubygem-jquery-rails-4.5.0-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-jquery-rails-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:06.91247Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:13159-1","title":"ruby3.2-rubygem-jquery-rails-4.5.1-1.3 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-jquery-rails-4.5.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:09:48.738361Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14169-1","title":"ruby3.3-rubygem-jquery-rails-4.6.0-1.5 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-jquery-rails-4.6.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T03:50:32.721448Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15117-1","title":"ruby3.4-rubygem-jquery-rails-4.6.0-1.7 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-jquery-rails-4.6.0-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:52:31.613858Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10350-1","title":"ruby4.0-rubygem-jquery-rails-4.6.0-1.9 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-jquery-rails-4.6.0-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.549803Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"UBUNTU-CVE-2015-1840","description":"jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.","status":"withdrawn","published":"2015-07-26T22:59:00Z","modified":"2025-07-16T08:30:12.390439Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}