PT-2018-18405 · Rubinius+4 · Rbx+4

Publicado 2018-03-21 · Atualizado 2026-03-13 · CVE-2018-8048

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Loofah versions prior to 2.2.1

Description: The issue allows non-whitelisted HTML attributes to be present in sanitized output when input with specially-crafted HTML fragments. Users are affected when running on MRI or RBX, in combination with libxml2 >= 2.9.2. JRuby users are not affected.

Recommendations: For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of libxml2 to a version less than 2.9.2 when running on MRI or RBX, until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-8048

DSA-4171-1

GHSA-X7RV-CR6V-4VM4

OPENSUSE-SU-2024:11337-1

OPENSUSE-SU-2024:11340-1

OPENSUSE-SU-2024:11900-1

OPENSUSE-SU-2024:11912-1

OPENSUSE-SU-2024:13162-1

OPENSUSE-SU-2024:13165-1

OPENSUSE-SU-2024:14171-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2025:15120-1

OPENSUSE-SU-2026:10353-1

OPENSUSE-SU-2026:10356-1

RHSA-2019:0212

SUSE-SU-2019:0394-1

SUSE-SU-2019:2209-1

SUSE-SU-2022:4075-1

Produtos afetados

Jruby

Loofah

Mri

Rbx

Libxml2

Referências · 87

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml · Exploit
• https://github.com/sparklemotion/nokogiri/pull/1746 · Nota
• https://github.com/flavorjones/loofah · Nota
• https://github.com/flavorjones/loofah/issues/144 · Nota
• https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116 · Nota
• https://suse.com/security/cve/CVE-2015-1819 · Nota
• https://suse.com/security/cve/CVE-2018-14404 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2026:10353-1 · Aviso do Fabricante
• https://debian.org/security/2018/dsa-4171 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:11912-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2022-23437 · Nota
• https://suse.com/security/cve/CVE-2015-7500 · Nota
• https://suse.com/security/cve/CVE-2014-0191 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:11900-1 · Aviso do Fabricante