Information disclosure in Rubyonrails Jquery-Rails
CVE-2015-1840
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.045 (91.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.045 · newest: 0.045 · change: 0.000
Affected products
- Rubyonrails Jquery-Rails — versions 4.0.0, 4.0.1
- Rubyonrails Jquery-Ujs
- Fedoraproject Fedora — versions 21, 22
- openSUSE — versions 13.1, 13.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html (vendor-advisory, Third Party Advisory)
- lists.opensuse.org/opensuse-updates/2015-07/msg00041.html (vendor-advisory, Third Party Advisory)
- openwall.com/lists/oss-security/2015/06/16/15 (mailing-list)
- lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.html (vendor-advisory, Third Party Advisory)
- groups.google.com/forum/message/raw (Vendor Advisory, mailing-list, Exploit)
- www.securityfocus.com/bid/75239 (vdb-entry)
- github.com/rails/jquery-ujs/blob/master/CHANGELOG.md (Vendor Advisory)
- github.com/rails/jquery-rails/blob/master/CHANGELOG.md (Vendor Advisory)
Frequently asked questions
- What is CVE-2015-1840?
- CVE-2015-1840 is a vulnerability in Rubyonrails Jquery-Rails, classified under Information Disclosure. Published 2015-07-26.
- Is CVE-2015-1840 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.