XSS in Jruby
CVE-2010-1330
The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.022 (80.8th percentile) — read the EPSS interpretation.
Affected products
- Jruby — versions 0.9.0, 0.9.1, 0.9.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Patch, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)