CVE:CVE-2019-15587
CNNVD:CNNVD-201910-1322
Loofah gem for Ruby是一款基于Ruby的、用于处理和转换HTML/XML文档的库。
Loofah gem for Ruby 2.3.0及之前版本中存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade loofah_project loofah to a higher version than 2.3.0,and avoid the version (,2.3.0]; Upgrade fedoraproject fedora to a higher version than 30,31,and avoid the version 30,31; Upgrade canonical ubuntu_linux to a higher version than 16.04,and avoid the version 16.04; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0