In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a     crafted SVG element is republished. (CVE-2019-15587)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a
    crafted SVG element is republished. (CVE-2019-15587)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3868-1 advisory.

    - CVE-2019-15587: Fixed issue in sanitization of crafted SVG elements (bsc#1154751).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4498-1 advisory.

    It was discovered that Loofah does not properly sanitize JavaScript in

    sanitized output. An attacker could possibly use this issue to perform

    XSS attacks. (CVE-2019-15587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix XXS when a crafted SVG element is republished.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, was susceptible to cross-site scripting.

GitHub issue :

This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported by https://hackerone.com/vxhex

In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

ID	Name	Product	Family	Severity
254933	Linux Distros Unpatched Vulnerability : CVE-2019-15587	Nessus	Misc.	medium
423124	SCA: security update for loofah (GHSA-c3gv-9cxf-6f57)	Tenable Cloud Security	SCA Checks	medium
423124	SCA: security update for loofah (GHSA-c3gv-9cxf-6f57)	Tenable Self-Hosted Container Security	SCA Checks	medium
167036	SUSE SLES15: ruby2.5-rubygem-loofah / ruby2.5-rubygem-loofah-doc / etc (SUSE-SU-2022:3868-1)	Nessus	SuSE Local Security Checks	medium
140600	Ubuntu 16.04 LTS : Loofah vulnerability (USN-4498-1)	Nessus	Ubuntu Local Security Checks	medium
134185	Fedora 30 : rubygem-loofah (2020-1ebc4b8284)	Nessus	Fedora Local Security Checks	medium
134184	Fedora 31 : rubygem-loofah (2020-03c0964b6a)	Nessus	Fedora Local Security Checks	medium
130351	Debian DSA-4554-1 : ruby-loofah - security update	Nessus	Debian Local Security Checks	medium
130183	FreeBSD : Loofah -- XSS vulnerability (a90d040e-f5b0-11e9-acc4-4576b265fda6)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-15587

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium