Repository navigation
Add advisory for will_paginate #272
Description
Activity
- added a commit that references this issue
on Oct 28, 2016 With a bit of experimentation, I discovered that adding
&script_name=https://www.example.comto a page with will_paginate links would result in the links being rewritten to be https://www.example.com... instead of the intended site. I guess someone could use this in a social engineering attack by sending someone a link with &script_name being a malicious site and hoping they click on the pagination links and getting fooled, but I'm not sure if it's any worse than that.@aripollak or @phillmv - Is this issue related to this existing advisory - gems/will_paginate/CVE-2013-6459.yml ?
ThanksHere is what I know about this issue (in advisory/yaml format) with notes:
Since this repo does not create contents or CVEs/GHSAs, I will be closing
this issue shortly. Speak up if you want to work on this.Reacted by Mike DalessioActing on my previous comment, I am closing this issue.
Apparently there was a security issue fixed here: mislav/will_paginate@ec9b985 and here: mislav/will_paginate@ab55687
It looks like versions before 3.1.2, 3.0.9, and are vulnerable, but this has no CVE and I'm not sure exactly what the vulnerability was.