CVE-2024-26143 Rails Possible XSS Vulnerability in Action Controller

2024-02-2715:33:54

CWE-79

GitHub_M

www.cve.org

cve-2024-26143

rails

xss

action controller

translation helpers

untrusted user input

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

10.5%

JSON

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in “_html”, a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.

CNA Affected

[
  {
    "vendor": "rails",
    "product": "rails",
    "versions": [
      {
        "version": ">= 7.0.0, < 7.0.8.1",
        "status": "affected"
      },
      {
        "version": ">= 7.1.0, < 7.1.3.1",
        "status": "affected"
      }
    ]
  }
]