Cross-site Scripting in actionpack
actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error Page. This issue has been patched with this [commit](https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4). This vulnerability is disputed by the Rails security team. It requires that the developer is tricked into copy pasting a malicious javascript-containing string into a development-only error page accessible only via localhost.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3704US | medium5.4 | — | ||
A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_tabl… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/rails/railsPACKAGE
- https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4WEB
- https://github.com/rails/rails/issues/46244WEB
- https://github.com/rails/rails/issues/46244#issuecomment-1380875153WEB
- https://github.com/rails/rails/pull/46269WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-3704ADVISORY
- https://vuldb.com/?id.212319WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan