Cross-site Scripting (XSS)

🗓️ 28 Apr 2022 11:03:05Reported by Veracode Vulnerability DatabaseType

rails XSS vulnerability in Action View tag helper

Reporter	Title	Published	Views	Family All 50
FreeBSD	Rails -- XSS vulnerabilities	26 Apr 202200:00	–	freebsd
attackerkb	CVE-2022-27777	26 May 202217:15	–	attackerkb
AstraLinux	Astra Linux – Vulnerability in Rails	14 Sep 202612:41	–	astralinux
BDU FSTEC	The vulnerability of the actionpack plugin in the Ruby on Rails software platform allows attackers to execute XSS attacks.	13 Jul 202200:00	–	bdu_fstec
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_2097)	1 Oct 202600:00	–	nessus
Tenable Nessus	Debian DSA-5372-1 : rails - security update	14 Mar 202300:00	–	nessus
Tenable Nessus	FreeBSD : Rails -- XSS vulnerabilities (9db93f3d-c725-11ec-9618-000d3ac47524)	30 Apr 202200:00	–	nessus
Tenable Nessus	RHEL 8 : Satellite 6.13 Release (Important) (RHSA-2023:2097)	28 Apr 202400:00	–	nessus
Tenable Nessus	Rocky Linux 8 : Satellite 6.13 Release (Important) (RLSA-2023:2097)	5 May 202300:00	–	nessus
Tenable Nessus	SUSE SLES15: ruby2.5-rubygem-activesupport-5_1 / etc (SUSE-SU-2022:3621-1)	19 Oct 202200:00	–	nessus

Vulners

Node

AND

rubyonrails railsMatch2:6.0.3.4+dfsg-1debian

AND

rubyonrails railsMatch2:5.2.2.1+dfsg-1+deb10u1debian

rubyonrails railsMatch2:5.2.2.1+dfsg-1+deb10u2debian

AND

rubyonrails railsMatch2:6.0.3.4+dfsg-1debian

rubyonrails railsRange7.0.0.alpha1–7.0.2.3ruby

rubyonrails railsRange6.1.0.rc1–6.1.5ruby

rubyonrails railsRange6.0.0.beta1–6.0.4.7ruby

rubyonrails railsRange5.0.0.beta1–5.2.7ruby

rubyonrails railsRange4.0.0.beta1–4.2.11.3ruby

rubyonrails railsRange3.0.0.beta–3.2.22.5ruby

rubyonrails railsRange2.0.0–2.3.18ruby

rubyonrails railsRange1.2.0–1.2.6ruby

Source	Link
rubyonrails	www.rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
groups	www.groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw
github	www.github.com/rails/rails/commit/5c7dae5a410ff49fe4dcf30b97ee0f9148114b66
github	www.github.com/rails/rails/commit/123f42a573f7fcbf391885c135ca809f21615180
github	www.github.com/rails/rails/commit/36a6dad07d572a0098c29d6d96a226638a7caa38
github	www.github.com/rails/rails/commit/1278c0f0b4a18ea199f92b666b8b94954a74c20b
lists	www.lists.debian.org/debian-lts-announce/2022/09/msg00002.html
debian	www.debian.org/security/2023/dsa-5372
github	www.github.com/advisories/GHSA-ch3h-j2vf-95pv

30 May 2023 04:38Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

CVSS 3.16.1

EPSS0.01639