Ubuntu.comUB:CVE-2022-3704CVE-2022-3704
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
21.8%
DISPUTED A vulnerability classified as problematic has been found in
Ruby on Rails. This affects an unknown part of the file
actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb.
The manipulation leads to cross site scripting. It is possible to initiate
the attack remotely. The real existence of this vulnerability is still
doubted at the moment. The name of the patch is
be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a
patch to fix this issue. The associated identifier of this vulnerability is
VDB-212319. NOTE: Maintainer declares that there isn’t a valid attack
vector. The issue was wrongly reported as a security vulnerability by a
non-member of the Rails team.
Notes
| Author | Note |
|---|---|
| seth-arnold | In Oneiric-Saucy, rails package is just for transition; The rails package contains actual code from vivid onward |
| eslerm | CVE possibly assigned based on commit message |
Related
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
21.8%