CVE-2015-1840

jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote…

published July 26, 2015

CVSS
—
EPSS
5%
Percentile
91.4
In the wild
Unconfirmed
What it is

jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04519 · 91.4th percentile
Published
2015-07-26T22:00Z
EPSS history
Timeline
  • 26 JUL 22:00Z
    jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote…
    cvelistv5