The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0698 advisory.

    Ruby on Rails is a modelviewcontroller (MVC) framework for web     application development. Action Pack implements the controller and the view     components.

    Two cross-site scripting (XSS) flaws were found in rubygem-actionpack and     ruby193-rubygem-actionpack. A remote attacker could use these flaws to     conduct XSS attacks against users of an application using     rubygem-actionpack or ruby193-rubygem-actionpack. (CVE-2013-1855,     CVE-2013-1857)

    Red Hat would like to thank Ruby on Rails upstream for reporting these     issues. Upstream acknowledges Charlie Somerville as the original reporter     of CVE-2013-1855, and Alan Jenkins as the original reporter of     CVE-2013-1857.

    Users of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to these     updated packages, which correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 : rubygem-actionpack and ruby193-rubygem-actionpack (RHSA-2013:0698)

medium Nessus Plugin ID 119434

Version 1.10