VDB

CVE-2017-12098

CVE-2017-12098 PUBLISHED CVSS 6.099999904632568 MEDIUM

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

EPSS 1.28% · 68.0th percentile

Risk Scores

CVSS 3.0
6.099999904632568
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
1.28%
68.0th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSruby-rails-admin0, 0.6.8~dfsg-1, 0.7.0~dfsg-2
Ubuntu:18.04:LTSruby-rails-admin0.8.1+dfsg-3, 0

Timeline

  • Jan 15, 2018 PoC Published
  • Jan 19, 2018 CVE Published
  • Feb 2, 2018 CVE Updated
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Mar 1, 2022 EPSS Score
  • May 3, 2022 EPSS Score
  • Jul 4, 2022 EPSS Score
  • Nov 8, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›