Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | centos-upgrade-foreman-clicentos-upgrade-python39-pulp_manifestcentos-upgrade-rubygem-amazing_printcentos-upgrade-rubygem-apipie-bindingscentos-upgrade-rubygem-clampcentos-upgrade-rubygem-domain_namecentos-upgrade-rubygem-fast_gettextcentos-upgrade-rubygem-fficentos-upgrade-rubygem-ffi-debuginfocentos-upgrade-rubygem-ffi-debugsourcecentos-upgrade-rubygem-foreman_maintaincentos-upgrade-rubygem-gssapicentos-upgrade-rubygem-hammer_clicentos-upgrade-rubygem-hammer_cli_foremancentos-upgrade-rubygem-hammer_cli_foreman_admincentos-upgrade-rubygem-hammer_cli_foreman_ansiblecentos-upgrade-rubygem-hammer_cli_foreman_azure_rmcentos-upgrade-rubygem-hammer_cli_foreman_bootdiskcentos-upgrade-rubygem-hammer_cli_foreman_discoverycentos-upgrade-rubygem-hammer_cli_foreman_googlecentos-upgrade-rubygem-hammer_cli_foreman_openscapcentos-upgrade-rubygem-hammer_cli_foreman_remote_executioncentos-upgrade-rubygem-hammer_cli_foreman_taskscentos-upgrade-rubygem-hammer_cli_foreman_templatescentos-upgrade-rubygem-hammer_cli_foreman_virt_who_configurecentos-upgrade-rubygem-hammer_cli_foreman_webhookscentos-upgrade-rubygem-hammer_cli_katellocentos-upgrade-rubygem-hashiecentos-upgrade-rubygem-highlinecentos-upgrade-rubygem-http-acceptcentos-upgrade-rubygem-http-cookiecentos-upgrade-rubygem-jwtcentos-upgrade-rubygem-little-pluggercentos-upgrade-rubygem-localecentos-upgrade-rubygem-loggingcentos-upgrade-rubygem-mime-typescentos-upgrade-rubygem-mime-types-datacentos-upgrade-rubygem-multi_jsoncentos-upgrade-rubygem-netrccentos-upgrade-rubygem-oauthcentos-upgrade-rubygem-oauth-ttycentos-upgrade-rubygem-powerbarcentos-upgrade-rubygem-rest-clientcentos-upgrade-rubygem-snaky_hashcentos-upgrade-rubygem-unfcentos-upgrade-rubygem-unf_extcentos-upgrade-rubygem-unf_ext-debuginfocentos-upgrade-rubygem-unf_ext-debugsourcecentos-upgrade-rubygem-unicodecentos-upgrade-rubygem-unicode-debuginfocentos-upgrade-rubygem-unicode-debugsourcecentos-upgrade-rubygem-unicode-display_widthcentos-upgrade-rubygem-version_gemcentos-upgrade-satellite-clicentos-upgrade-satellite-clonecentos-upgrade-satellite-maintain | May 4, 2023 | Dec 14, 2022 |
| Debian | debian-upgrade-ruby-loofah | Sep 15, 2023 | Dec 14, 2022 | |
| Redhat_linux | — | redhat-upgrade-foreman-cliredhat-upgrade-python39-pulp_manifestredhat-upgrade-rubygem-amazing_printredhat-upgrade-rubygem-apipie-bindingsredhat-upgrade-rubygem-clampredhat-upgrade-rubygem-domain_nameredhat-upgrade-rubygem-fast_gettextredhat-upgrade-rubygem-ffiredhat-upgrade-rubygem-ffi-debuginforedhat-upgrade-rubygem-ffi-debugsourceredhat-upgrade-rubygem-foreman_maintainredhat-upgrade-rubygem-gssapiredhat-upgrade-rubygem-hammer_cliredhat-upgrade-rubygem-hammer_cli_foremanredhat-upgrade-rubygem-hammer_cli_foreman_adminredhat-upgrade-rubygem-hammer_cli_foreman_ansibleredhat-upgrade-rubygem-hammer_cli_foreman_azure_rmredhat-upgrade-rubygem-hammer_cli_foreman_bootdiskredhat-upgrade-rubygem-hammer_cli_foreman_discoveryredhat-upgrade-rubygem-hammer_cli_foreman_googleredhat-upgrade-rubygem-hammer_cli_foreman_openscapredhat-upgrade-rubygem-hammer_cli_foreman_remote_executionredhat-upgrade-rubygem-hammer_cli_foreman_tasksredhat-upgrade-rubygem-hammer_cli_foreman_templatesredhat-upgrade-rubygem-hammer_cli_foreman_virt_who_configureredhat-upgrade-rubygem-hammer_cli_foreman_webhooksredhat-upgrade-rubygem-hammer_cli_katelloredhat-upgrade-rubygem-hashieredhat-upgrade-rubygem-highlineredhat-upgrade-rubygem-http-acceptredhat-upgrade-rubygem-http-cookieredhat-upgrade-rubygem-jwtredhat-upgrade-rubygem-little-pluggerredhat-upgrade-rubygem-localeredhat-upgrade-rubygem-loggingredhat-upgrade-rubygem-mime-typesredhat-upgrade-rubygem-mime-types-dataredhat-upgrade-rubygem-multi_jsonredhat-upgrade-rubygem-netrcredhat-upgrade-rubygem-oauthredhat-upgrade-rubygem-oauth-ttyredhat-upgrade-rubygem-powerbarredhat-upgrade-rubygem-rest-clientredhat-upgrade-rubygem-snaky_hashredhat-upgrade-rubygem-unfredhat-upgrade-rubygem-unf_extredhat-upgrade-rubygem-unf_ext-debuginforedhat-upgrade-rubygem-unf_ext-debugsourceredhat-upgrade-rubygem-unicoderedhat-upgrade-rubygem-unicode-debuginforedhat-upgrade-rubygem-unicode-debugsourceredhat-upgrade-rubygem-unicode-display_widthredhat-upgrade-rubygem-version_gemredhat-upgrade-satellite-cliredhat-upgrade-satellite-cloneredhat-upgrade-satellite-maintain | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | rocky-upgrade-libdb-cxxrocky-upgrade-libdb-cxx-debuginforocky-upgrade-libdb-debuginforocky-upgrade-libdb-debugsourcerocky-upgrade-libdb-sql-debuginforocky-upgrade-libdb-sql-devel-debuginforocky-upgrade-libdb-utils-debuginfo | Mar 12, 2024 | Dec 14, 2022 | |
| Suse | — | suse-upgrade-ruby2-5-rubygem-loofahsuse-upgrade-ruby2-5-rubygem-loofah-docsuse-upgrade-ruby2-5-rubygem-loofah-testsuite | Mar 30, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub