Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-foreman_maintainUpgrade satellite-cloneUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade rubygem-oauthUpgrade rubygem-little-pluggerUpgrade rubygem-snaky_hashUpgrade rubygem-multi_jsonUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-jwtUpgrade rubygem-unicodeUpgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-oauth-ttyUpgrade rubygem-apipie-bindingsUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-amazing_printUpgrade satellite-cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffiUpgrade rubygem-unf_extUpgrade rubygem-localeUpgrade rubygem-loggingUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-ffi-debugsourceUpgrade foreman-cliUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cliUpgrade rubygem-http-cookieUpgrade rubygem-http-acceptUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-gssapiUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifestUpgrade rubygem-hashieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-version_gemUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_discovery | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-loofah | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-unicode-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-fast_gettextUpgrade rubygem-snaky_hashUpgrade rubygem-unf_extUpgrade rubygem-unicodeUpgrade python39-pulp_manifestUpgrade rubygem-loggingUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-typesUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cliUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-http-acceptUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-clampUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-display_widthUpgrade rubygem-powerbarUpgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade rubygem-oauthUpgrade rubygem-rest-clientUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-hashieUpgrade foreman-cliUpgrade satellite-cloneUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unf_ext-debuginfo | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-loofah-testsuiteUpgrade ruby2.5-rubygem-loofah-docUpgrade ruby2.5-rubygem-loofah | Mar 30, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub