In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3868-1 advisory.

  - In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a     crafted SVG element is republished. (CVE-2019-15587)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4498-1 advisory.

    It was discovered that Loofah does not properly sanitize JavaScript in

    sanitized output. An attacker could possibly use this issue to perform

    XSS attacks. (CVE-2019-15587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix XXS when a crafted SVG element is republished.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, was susceptible to cross-site scripting.

GitHub issue :

This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported by https://hackerone.com/vxhex

In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

ID	Name	Product	Family	Severity
167036	SUSE SLES15 Security Update : rubygem-loofah (SUSE-SU-2022:3868-1)	Nessus	SuSE Local Security Checks	medium
140600	Ubuntu 16.04 LTS : Loofah vulnerability (USN-4498-1)	Nessus	Ubuntu Local Security Checks	medium
134185	Fedora 30 : rubygem-loofah (2020-1ebc4b8284)	Nessus	Fedora Local Security Checks	medium
134184	Fedora 31 : rubygem-loofah (2020-03c0964b6a)	Nessus	Fedora Local Security Checks	medium
130351	Debian DSA-4554-1 : ruby-loofah - security update	Nessus	Debian Local Security Checks	medium
130183	FreeBSD : Loofah -- XSS vulnerability (a90d040e-f5b0-11e9-acc4-4576b265fda6)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-15587

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium