Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-ffiUpgrade rubygem-hashieUpgrade rubygem-unf_extUpgrade rubygem-localeUpgrade rubygem-loggingUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade foreman-cliUpgrade rubygem-mime-typesUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debugsourceUpgrade rubygem-http-cookieUpgrade rubygem-domain_nameUpgrade rubygem-gssapiUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-amazing_printUpgrade rubygem-clampUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-version_gemUpgrade rubygem-highlineUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-snaky_hashUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-oauthUpgrade satellite-cloneUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-rest-clientUpgrade rubygem-oauth-ttyUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-display_widthUpgrade rubygem-mime-types-dataUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templates | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-loofah | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-apipie-bindingsUpgrade rubygem-hashieUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-little-pluggerUpgrade rubygem-foreman_maintainUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-ffiUpgrade foreman-cliUpgrade satellite-cliUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-clampUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unfUpgrade satellite-maintainUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-rest-clientUpgrade rubygem-netrcUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-types-dataUpgrade rubygem-powerbarUpgrade rubygem-ffi-debuginfoUpgrade rubygem-gssapiUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-domain_nameUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade rubygem-version_gemUpgrade rubygem-hammer_cliUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-snaky_hashUpgrade rubygem-unicodeUpgrade python39-pulp_manifestUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffi-debugsource | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-loofahUpgrade ruby2.5-rubygem-loofah-docUpgrade ruby2.5-rubygem-loofah-testsuite | Mar 30, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub