GitHub Advisory DatabaseGHSA-CQF3-VPX7-RXHWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS
Percentile
36.1%
Impact
A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality.
Patches
This has been patched in version 6.3.2 and above.
Pay will now sanitize the back parameter and only permit relative paths.
Affected configurations
References
github.com/advisories/GHSA-cqf3-vpx7-rxhw
github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f
github.com/pay-rails/pay/commit/c067771d8c7514acde4b948b474caf054bb0e25d
github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw
github.com/rubysec/ruby-advisory-db/blob/master/gems/pay/CVE-2023-30614.yml
nvd.nist.gov/vuln/detail/CVE-2023-30614
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS
Percentile
36.1%