CVE-2017-12098 json
rails_admin ruby gem XSS
published 2018-01-19 8 y ago modified 2026-06-17 4 mo ago also GHSA-pxr8-w3jq-rcwj , EUVD-2018-0183
- cvss
- 6.1
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Patch / fix
- rubygems rails_admin 1.3.0
Exploit prediction
1.28% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- talosintelligence.com https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | rails_admin | <1.3.0 |
1.3.0 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
talosintelligence.com
/vulnerability_reports/TALOS-2017-0450
web, exploit, third-party-advisory
-
securityfocus.com
/bid/102486
vdb-entry, broken-link, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-12098
advisory
-
github.com
/advisories/GHSA-pxr8-w3jq-rcwj
advisory
-
github.com
/railsadminteam/rails_admin
web
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/rails_admin/CVE-2017-12098.yml
web
-
web.archive.org
/web/20210116160904/http://www.securityfocus.com/bid/102486
web
Sources
- CVE List CVE-2017-12098
- GitHub Advisory GHSA-pxr8-w3jq-rcwj
- NVD CVE-2017-12098
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.