Cross-site Scripting in actionpack
actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error Page. This issue has been patched with this [commit](https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4). This vulnerability is disputed by the Rails security team. It requires that the developer is tricked into copy pasting a malicious javascript-containing string into a development-only error page accessible only via localhost.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-3704US | medium5.4 | — | ||
A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_tabl… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/rails/railsPACKAGE
- https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4WEB
- https://github.com/rails/rails/issues/46244WEB
- https://github.com/rails/rails/issues/46244#issuecomment-1380875153WEB
- https://github.com/rails/rails/pull/46269WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-3704ADVISORY
- https://vuldb.com/?id.212319WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan