Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-debugsourceUpgrade satellite-cloneUpgrade rubygem-unicodeUpgrade satellite-maintainUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-mime-types-dataUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-multi_jsonUpgrade rubygem-oauthUpgrade rubygem-jwtUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-hashieUpgrade python39-pulp_manifestUpgrade rubygem-mime-typesUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-amazing_printUpgrade rubygem-ffiUpgrade rubygem-clampUpgrade rubygem-localeUpgrade rubygem-loggingUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-ffi-debuginfoUpgrade satellite-cliUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade rubygem-version_gemUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-domain_nameUpgrade rubygem-http-acceptUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_webhooks | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-loofah | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-http-cookieUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-snaky_hashUpgrade rubygem-unf_extUpgrade python39-pulp_manifestUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-multi_jsonUpgrade rubygem-version_gemUpgrade rubygem-unicode-debuginfoUpgrade rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-http-acceptUpgrade rubygem-mime-typesUpgrade rubygem-unicode-display_widthUpgrade foreman-cliUpgrade satellite-cloneUpgrade rubygem-little-pluggerUpgrade rubygem-hashieUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-highlineUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-mime-types-dataUpgrade rubygem-oauthUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-apipie-bindingsUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-rest-client | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-loofahUpgrade ruby2.5-rubygem-loofah-testsuiteUpgrade ruby2.5-rubygem-loofah-doc | Mar 30, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub