Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-oauth-ttyUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unfUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-jwtUpgrade rubygem-rest-clientUpgrade rubygem-unicodeUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-display_widthUpgrade rubygem-multi_jsonUpgrade rubygem-netrcUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_katelloUpgrade satellite-maintainUpgrade rubygem-highlineUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-http-cookieUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-localeUpgrade rubygem-loggingUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-powerbarUpgrade rubygem-unf_extUpgrade rubygem-amazing_printUpgrade rubygem-version_gemUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-clampUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifest | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-loofah | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-domain_nameUpgrade rubygem-snaky_hashUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-http-cookieUpgrade rubygem-version_gemUpgrade rubygem-http-acceptUpgrade rubygem-unf_extUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-localeUpgrade rubygem-gssapiUpgrade rubygem-jwtUpgrade rubygem-unicode-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-loggingUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-multi_jsonUpgrade foreman-cliUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-little-pluggerUpgrade satellite-cloneUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-rest-clientUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-clampUpgrade rubygem-unicode-display_widthUpgrade rubygem-powerbarUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-oauth-ttyUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hashieUpgrade rubygem-ffiUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cli | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-loofah-testsuiteUpgrade ruby2.5-rubygem-loofah-docUpgrade ruby2.5-rubygem-loofah | Mar 30, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub