CVE-2015-1840: Jquery rails Jquery-rails And Jquery-ujs Subject To Vulnerability
MODERATECVE-2015-1840 is a MODERATE jquery-rails and jquery-ujs subject to vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Jquery rails libraries in the RubyGems ecosystem. The issue involves jquery-rails and jquery-ujs subject to exposure of sensitive information. Remediation is available by upgrading affected packages to version 3.1.3, 4.0.4, 1.0.4.
CVE-2015-1840 at a Glance
How to Fix CVE-2015-1840
To remediate this vulnerability, upgrade all affected Jquery rails dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade jquery-rails to 3.1.3Upgrade jquery-rails to 4.0.4Upgrade jquery-ujs to 1.0.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for jquery-railsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2015-1840, inspect your project dependencies for Jquery rails:
inspect dependencies for jquery-railsAnalyze the terminal output to locate any version of Jquery rails in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.1.3), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Jquery rails, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2015-1840 Affected Jquery rails Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
jquery-rails
|
RubyGems |
< 3.1.3
|
3.1.3
|
|
jquery-rails
|
RubyGems |
≥ 4.0.0
< 4.0.4
|
4.0.4
|
|
jquery-ujs
|
RubyGems |
< 1.0.4
|
1.0.4
|
References
Frequently Asked Questions
What is CVE-2015-1840?
Which Jquery rails versions are affected?
What version fixes CVE-2015-1840?
Is jquery-rails affected?
Is jquery-ujs affected?
What CWE is associated with CVE-2015-1840?
How can I check RubyGems dependencies for CVE-2015-1840?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4whc-pp4x-9pf3",
"modified" : "2026-01-14T21:44:14Z",
"published" : "2017-10-24T18:33:36Z",
"aliases" : [ "CVE-2015-1840" ],
"summary" : "jquery-rails and jquery-ujs subject to Exposure of Sensitive Information",
"details" : "jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "RubyGems",
"name" : "jquery-rails"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.1.3"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "jquery-rails"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0"
}, {
"fixed" : "4.0.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "jquery-ujs"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.0.4"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2015-1840"
}, {
"type" : "ADVISORY",
"url" : "https://github.com/advisories/GHSA-4whc-pp4x-9pf3"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/rails/jquery-rails"
}, {
"type" : "WEB",
"url" : "https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md"
}, {
"type" : "WEB",
"url" : "https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md"
}, {
"type" : "WEB",
"url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2015-1840.yml"
}, {
"type" : "WEB",
"url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ujs/CVE-2015-1840.yml"
}, {
"type" : "WEB",
"url" : "https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY"
}, {
"type" : "WEB",
"url" : "https://groups.google.com/forum/message/raw?msg=rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J"
}, {
"type" : "WEB",
"url" : "https://web.archive.org/web/20200228084945/http://www.securityfocus.com/bid/75239"
}, {
"type" : "WEB",
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.html"
}, {
"type" : "WEB",
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html"
}, {
"type" : "WEB",
"url" : "http://lists.opensuse.org/opensuse-updates/2015-07/msg00041.html"
}, {
"type" : "WEB",
"url" : "http://openwall.com/lists/oss-security/2015/06/16/15"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2020-06-16T20:59:28Z",
"nvd_published_at" : "2015-07-26T22:59:00Z"
}
}