Vulnerabilities found in loofah 2.0.3

[ghardytest]

CVE-2018-8048

Description: In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.
Discovery Date: 2018-04-24
CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score: 4.3

Exploitability score: 8.6
Impact score: 2.9

Vendors

• debian

References

• DSA-4171
• CVE-2018-8048 - Loofah XSS Vulnerability flavorjones/loofah#144
• [oss-security] 20180319 [CVE-2018-8048] Loofah XSS Vulnerability