CVE-2017-12098

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 19, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-120997.8An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.7CVE-2017-12107.5IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files mCVE-2017-121007.8An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A spCVE-2017-121017.8An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite CVE-2017-121027.8An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A speciCVE-2017-121037.8An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font intCVE-2017-121047.8An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A speciallyCVE-2017-121057.8An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifierCVE-2017-121067.8A memory corruption vulnerability exists in the .TGA parsing functionality of Computerinsel Photoline 20.02. A specially crafted .TGA file cCVE-2017-121077.8An memory corruption vulnerability exists in the .PCX parsing functionality of Computerinsel Photoline 20.02. A specially crafted .PCX file CVE-2017-121088.8An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A CVE-2017-121098.8An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULRK record. A spe
CVE-2017-12098: Medium severity, CVSS 6.1 | Vulnix