Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-3704
HistoryOct 26, 2022 - 12:00 a.m.

CVE-2022-3704

2022-10-2600:00:00
ubuntu.com
ubuntu.com
14

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

21.7%

DISPUTED A vulnerability classified as problematic has been found in
Ruby on Rails. This affects an unknown part of the file
actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb.
The manipulation leads to cross site scripting. It is possible to initiate
the attack remotely. The real existence of this vulnerability is still
doubted at the moment. The name of the patch is
be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a
patch to fix this issue. The associated identifier of this vulnerability is
VDB-212319. NOTE: Maintainer declares that there isn’t a valid attack
vector. The issue was wrongly reported as a security vulnerability by a
non-member of the Rails team.

Notes

Author Note
seth-arnold In Oneiric-Saucy, rails package is just for transition; The rails package contains actual code from vivid onward
eslerm CVE possibly assigned based on commit message

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

21.7%