Cross-site Scripting (XSS)

🗓️ 28 Apr 2022 11:03:05Reported by Veracode Vulnerability DatabaseType

rails XSS vulnerability in Action View tag helper

Reporter	Title	Published	Views	Family All 66
FreeBSD	Rails -- XSS vulnerabilities	26 Apr 202200:00	–	freebsd
ATTACKERKB	CVE-2022-27777	26 May 202217:15	–	attackerkb
AstraLinux	Astra Linux - уязвимость в rails	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the actionpack plugin in the Ruby on Rails software platform allows attackers to execute XSS attacks.	13 Jul 202200:00	–	bdu_fstec
Circl	CVE-2022-27777	26 May 202220:14	–	circl
CNNVD	Action View tag helpers 跨站脚本漏洞	26 May 202200:00	–	cnnvd
CVE	CVE-2022-27777	26 May 202200:00	–	cve
Cvelist	CVE-2022-27777	26 May 202200:00	–	cvelist
Debian	[SECURITY] [DLA 3093-1] rails security update	3 Sep 202211:34	–	debian
Debian	[SECURITY] [DSA 5372-1] rails security update	13 Mar 202303:06	–	debian

Vulners

Node

rubyonrails railsMatch2:6.0.3.4+dfsg-1debian

AND

rubyonrails railsMatch2:5.2.2.1+dfsg-1+deb10u1debian

AND

rubyonrails railsMatch2:5.2.2.1+dfsg-1+deb10u2debian

AND

rubyonrails railsMatch2:6.0.3.4+dfsg-1debian

AND

rubyonrails railsRange7.0.0.alpha1–7.0.2.3ruby

rubyonrails railsRange6.1.0.rc1–6.1.5ruby

rubyonrails railsRange6.0.0.beta1–6.0.4.7ruby

rubyonrails railsRange5.0.0.beta1–5.2.7ruby

rubyonrails railsRange4.0.0.beta1–4.2.11.3ruby

rubyonrails railsRange3.0.0.beta–3.2.22.5ruby

rubyonrails railsRange2.0.0–2.3.18ruby

rubyonrails railsRange1.2.0–1.2.6ruby

Source	Link
rubyonrails	www.rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
groups	www.groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw
github	www.github.com/rails/rails/commit/5c7dae5a410ff49fe4dcf30b97ee0f9148114b66
github	www.github.com/rails/rails/commit/123f42a573f7fcbf391885c135ca809f21615180
github	www.github.com/rails/rails/commit/36a6dad07d572a0098c29d6d96a226638a7caa38
github	www.github.com/rails/rails/commit/1278c0f0b4a18ea199f92b666b8b94954a74c20b
lists	www.lists.debian.org/debian-lts-announce/2022/09/msg00002.html
debian	www.debian.org/security/2023/dsa-5372
github	www.github.com/advisories/GHSA-ch3h-j2vf-95pv

30 May 2023 04:38Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

CVSS 3.16.1

EPSS0.00852