CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
RailsAdmin list view has the XSS vulnerability, caused by
improperly-escaped HTML title attribute. The issue was originally
reported in https://github.com/railsadminteam/rails_admin/issues/3686.
Copy the index view (located under the path
app/views/rails_admin/main/index.html.erb
) from the RailsAdmin
version you use, and place it into your application by using
the same path.
Open the view file by an editor, and remove strip_tags
from
the title attribute (as shown in GHSA advisory below).
Note: The view file created by this needs to be removed after
upgrading RailsAdmin afterwards, unless this old view continue to
be used. Only do this if you can’t upgrade RailsAdmin now for a reason.
https://owasp.org/www-community/attacks/xss/
https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags
Vendor | Product | Version | CPE |
---|---|---|---|
ruby | rails_admin | * | cpe:2.3:a:ruby:rails_admin:*:*:*:*:*:*:*:* |