Cross-Site Scripting (XSS)

🗓️ 28 Apr 2022 06:17:13Reported by Veracode Vulnerability DatabaseType

actionpack vulnerability to cross-site scripting in content_security_policy.r

Reporter	Title	Published	Views	Family All 48
FreeBSD	Rails -- XSS vulnerabilities	26 Apr 202200:00	–	freebsd
ATTACKERKB	CVE-2022-22577	26 May 202217:15	–	attackerkb
AstraLinux	Astra Linux – Vulnerability in Rails	3 May 202623:59	–	astralinux
Circl	CVE-2022-22577	26 May 202220:14	–	circl
CNNVD	Rails Action Pack 跨站脚本漏洞	26 May 202200:00	–	cnnvd
CVE	CVE-2022-22577	26 May 202200:00	–	cve
Cvelist	CVE-2022-22577	26 May 202200:00	–	cvelist
Debian	[SECURITY] [DLA 3093-1] rails security update	3 Sep 202211:34	–	debian
Debian	[SECURITY] [DSA 5372-1] rails security update	13 Mar 202303:06	–	debian
Debian CVE	CVE-2022-22577	26 May 202200:00	–	debiancve

Vulners

Node

rubyonrails railsMatch2:6.0.3.4+dfsg-1debian

AND

rubyonrails railsMatch2:5.2.2.1+dfsg-1+deb10u2debian

AND

rubyonrails railsMatch2:5.2.2.1+dfsg-1+deb10u1debian

AND

rubyonrails railsMatch2:6.0.3.4+dfsg-1debian

AND

actionpack_project actionpackRange5.2.0.beta1–5.2.7ruby

actionpack_project actionpackRange6.0.0.beta1–6.0.4.7ruby

actionpack_project actionpackRange7.0.0.alpha1–7.0.2.3ruby

Source	Link
github	www.github.com/rails/rails/pull/44635
discuss	www.discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533
groups	www.groups.google.com/g/ruby-security-ann/c/NuFRKaN5swI
github	www.github.com/rails/rails/commit/803f87567f0cd11295f4155189417225747e115c
lists	www.lists.debian.org/debian-lts-announce/2022/09/msg00002.html
debian	www.debian.org/security/2023/dsa-5372
github	www.github.com/advisories/GHSA-mm33-5vfq-3mm3
security	www.security.netapp.com/advisory/ntap-20221118-0002/

14 Mar 2023 10:47Current

4.1Medium risk

Vulners AI Score4.1

CVSS 24.3

CVSS 3.16.1

EPSS0.01594