CVE:CVE-2009-4214
CNNVD:CNNVD-200912-076
Ruby on Rails是Rails团队的一套基于Ruby语言的开源Web应用框架。
Ruby on Rails的strip_tags函数中存在跨站脚本漏洞。由于HTML::Tokenizer的解析代码在处理不可打印ascii字符时的错误，攻击者可以包含某些浏览器会评估的值，导致在用户浏览器会话中执行任意代码。
solution:Upgrade rubyonrails rails to a higher version than 2.3.2,2.3.3,2.3.4,0.9.1,0.9.2,0.9.3,0.9.4,0.9.4.1,0.10.0,0.10.1,0.11.0,0.11.1,0.12.0,0.12.1,0.13.0,0.13.1,0.14.1,0.14.2,0.14.3,0.14.4,1.0.0,1.1.0,1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.2.0,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.9.5,2.0.0,2.0.0:rc1,2.0.0:rc2,2.0.1,2.0.2,2.0.4,2.1.0,2.1.1,and avoid the version 2.3.2,2.3.3,2.3.4,0.9.1,0.9.2,0.9.3,0.9.4,0.9.4.1,0.10.0,0.10.1,0.11.0,0.11.1,0.12.0,0.12.1,0.13.0,0.13.1,0.14.1,0.14.2,0.14.3,0.14.4,1.0.0,1.1.0,1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.2.0,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.9.5,2.0.0,2.0.0:rc1,2.0.0:rc2,2.0.1,2.0.2,2.0.4,2.1.0,2.1.1; Upgrade rubyonrails ruby_on_rails to a higher version than 2.1.2,0.5.0,0.5.5,0.5.6,0.5.7,0.6.0,0.6.5,0.7.0,0.8.0,0.8.5,0.9.0,and avoid the version (,2.1.2],0.5.0,0.5.5,0.5.6,0.5.7,0.6.0,0.6.5,0.7.0,0.8.0,0.8.5,0.9.0