CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS
Percentile
36.1%
A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality.
This has been patched in version 6.3.2 and above.
Pay will now sanitize the back
parameter and only permit relative paths.
github.com/pay-rails/pay
github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f
github.com/pay-rails/pay/commit/c067771d8c7514acde4b948b474caf054bb0e25d
github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw
github.com/rubysec/ruby-advisory-db/blob/master/gems/pay/CVE-2023-30614.yml
nvd.nist.gov/vuln/detail/CVE-2023-30614