{"id":"CVE-2011-2197","url":"https://www.cyber-defence.io/tools/cve/CVE-2011-2197","generatedAt":"2026-10-27T19:43:20.374Z","title":"The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via…","description":"The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.","published":"2011-06-30T15:55:02.000Z","lastModified":"2026-06-16T23:30:54.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"2.0","score":4.3,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},"cwe":["CWE-79"],"affected":["rubyonrails/rails","rubyonrails/ruby on rails"],"epss":{"score":0.01962,"percentile":0.80197,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.96%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain","tags":["Patch"],"source":"secalert@redhat.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html","source":"secalert@redhat.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html","source":"secalert@redhat.com"},{"url":"http://openwall.com/lists/oss-security/2011/06/09/2","tags":["Patch"],"source":"secalert@redhat.com"},{"url":"http://openwall.com/lists/oss-security/2011/06/13/9","tags":["Patch"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/44789","tags":["Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications","tags":["Patch"],"source":"secalert@redhat.com"},{"url":"http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://openwall.com/lists/oss-security/2011/06/09/2","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://openwall.com/lists/oss-security/2011/06/13/9","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/44789","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-2197","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}