AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2011-2197

MEDIUM · CVSS 4.3 EPSS 1.96%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2011-06-30 · Last synced 2026-08-04

CyberRota Analysis

This is a medium severity vulnerability with a CVSS score of 4.3. It may be remotely exploitable.

CVE
CVE-2011-2197
Severity
MEDIUM
CVSS
4.3
EPSS
1.96%

Original NVD Description

The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.