CVE-2017-12097

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Talos	delayed_job_web rails gem	delayed\_job\_web 1.4

References

http://www.securityfocus.com/bid/102484Broken Link, Third Party Advisory, VDB Entry
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0449Exploit, Third Party Advisory
http://www.securityfocus.com/bid/102484Broken Link, Third Party Advisory, VDB Entry
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0449Exploit, Third Party Advisory

Timeline

Published: Jan 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-120986.1An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A CVE-2017-120997.8An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.7 CVE-2017-12107.5IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files m CVE-2017-121007.8An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A sp CVE-2017-121017.8An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite CVE-2017-121027.8An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A speci CVE-2017-121037.8An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font int CVE-2017-121047.8An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A specially CVE-2017-121057.8An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifier CVE-2017-121067.8A memory corruption vulnerability exists in the .TGA parsing functionality of Computerinsel Photoline 20.02. A specially crafted .TGA file c CVE-2017-121077.8An memory corruption vulnerability exists in the .PCX parsing functionality of Computerinsel Photoline 20.02. A specially crafted .PCX file CVE-2017-121088.8An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A