GitHub Advisoryadvisory · RubyGems

GHSA-pc3m-v286-2jwj actionview Cross-site Scripting vulnerability

MEDIUM Published 2017-10-24 Modified 2023-01-23 Official page ↗
Aliases
CVE-2016-6316
Ecosystem
RubyGems
Packages
actionview
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems actionview: >= 3.0.0, < 3.2.22.3 → fixed in 3.2.22.3 • RubyGems actionview: >= 4.0.0, < 4.2.7.1 → fixed in 4.2.7.1 • RubyGems actionview: >= 5.0.0, < 5.0.0.1 → fixed in 5.0.0.1

Description

Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.

Related

Alias · CVE (1)

  • CVE-2016-6316 Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References