Cross-site Scripting Vulnerability in Action Pack

🗓️ 27 Apr 2022 22:28:59Reported by GitHub Advisory DatabaseType

Possible XSS vulnerability in Rails Action Pack, CVE-2022-2257

Reporter	Title	Published	Views	Family All 48
FreeBSD	Rails -- XSS vulnerabilities	26 Apr 202200:00	–	freebsd
ATTACKERKB	CVE-2022-22577	26 May 202217:15	–	attackerkb
AstraLinux	Astra Linux - уязвимость в rails	20 May 202605:53	–	astralinux
Circl	CVE-2022-22577	26 May 202220:14	–	circl
CNNVD	Rails Action Pack 跨站脚本漏洞	26 May 202200:00	–	cnnvd
CVE	CVE-2022-22577	26 May 202200:00	–	cve
Cvelist	CVE-2022-22577	26 May 202200:00	–	cvelist
Debian	[SECURITY] [DLA 3093-1] rails security update	3 Sep 202211:34	–	debian
Debian	[SECURITY] [DSA 5372-1] rails security update	13 Mar 202303:06	–	debian
Debian CVE	CVE-2022-22577	26 May 202200:00	–	debiancve

Vulners

Node

actionpack_project actionpackRange7.0.0–7.0.2.3rubygems

actionpack_project actionpackRange6.1.0–6.1.5.0rubygems

actionpack_project actionpackRange6.0.0–6.0.4.7rubygems

actionpack_project actionpackRange5.2.0–5.2.7.0rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-22577
github	www.github.com/rails/rails/pull/44635
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-22577.yml
groups	www.groups.google.com/g/ruby-security-ann/c/NuFRKaN5swI
rubyonrails	www.rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
discuss	www.discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533
lists	www.lists.debian.org/debian-lts-announce/2022/09/msg00002.html
security	www.security.netapp.com/advisory/ntap-20221118-0002/
github	www.github.com/rails/rails/commit/2b820a2a69fa50cffa74b4aedc57bf92ed6910ec
github	www.github.com/rails/rails/commit/5299b57d596ea274f77f5ffee2b79c6ee0255508

13 Apr 2023 22:35Current

2.1Low risk

Vulners AI Score2.1

CVSS 24.3

CVSS 3.16.1

EPSS0.00405