GitHub Advisoryadvisory · RubyGems

GHSA-mm33-5vfq-3mm3 Cross-site Scripting Vulnerability in Action Pack

MEDIUM Published 2022-04-27 Modified 2022-06-08 Official page ↗
Aliases
CVE-2022-22577
Ecosystem
RubyGems
Packages
actionpack
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-04-27

Affected packages

• RubyGems actionpack: >= 5.2.0, < 5.2.7.1 → fixed in 5.2.7.1 • RubyGems actionpack: >= 6.0.0, < 6.0.4.8 → fixed in 6.0.4.8 • RubyGems actionpack: >= 6.1.0, < 6.1.5.1 → fixed in 6.1.5.1 • RubyGems actionpack: >= 7.0.0, < 7.0.2.4 → fixed in 7.0.2.4

Description

There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been assigned the CVE identifier CVE-2022-22577. Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1 Impact CSP headers were only sent along with responses that Rails considered as "HTML" responses. This left API requests without CSP headers, which could possibly expose users to XSS attacks. Releases The FIXED releases are available at the normal locations. Workarounds Set a CSP for your API responses manually.

Related

Alias · CVE (1)

  • CVE-2022-22577 An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References