~ / search / GHSA-mm33-5vfq-3mm3

GHSA-mm33-5vfq-3mm3

Cross-site Scripting Vulnerability in Action Pack

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-22577

Packages

EcosystemPackageAffectedFixed in
RubyGems actionpack >= 5.2.0, < 5.2.7.1 5.2.7.1
RubyGems actionpack >= 6.0.0, < 6.0.4.8 6.0.4.8
RubyGems actionpack >= 6.1.0, < 6.1.5.1 6.1.5.1
RubyGems actionpack >= 7.0.0, < 7.0.2.4 7.0.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been assigned the CVE identifier CVE-2022-22577. Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1 ## Impact CSP headers were only sent along with responses that Rails considered as "HTML" responses. This left API requests without CSP headers, which could possibly expose users to XSS attacks. ## Releases The FIXED releases are available at the normal locations. ## Workarounds Set a CSP for your API responses manually.

References

External links from the advisory. They lead to third-party sites.