GHSA-9chr-4fjh-5rgw
Cross-site Scripting in actionpack
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| RubyGems | actionpack | <= 7.0.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error Page. This issue has been patched with this [commit](https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4).
This vulnerability is disputed by the Rails security team. It requires that the developer is tricked into copy pasting a malicious javascript-containing string into a development-only error page accessible only via localhost.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-3704
- https://github.com/rails/rails/issues/46244
- https://github.com/rails/rails/issues/46244#issuecomment-1380875153
- https://github.com/rails/rails/pull/46269
- https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4
- https://github.com/rails/rails
- https://vuldb.com/?id.212319