CVE-2024-22048

Опубликовано: 04 янв. 2024

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.

Ссылки

https://github.com/advisories/GHSA-x2xw-hw8g-6773
Patch
Vendor Advisory
https://github.com/alphagov/tech-docs-gem/pull/323
Patch
Vendor Advisory
https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1
Patch
Release Notes
https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773
Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773
Patch
Third Party Advisory
https://github.com/advisories/GHSA-x2xw-hw8g-6773
Patch
Vendor Advisory
https://github.com/alphagov/tech-docs-gem/pull/323
Patch
Vendor Advisory
https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1
Patch
Release Notes
https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773
Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gov.uk:govuk_tech_docs:*:*:*:*:*:ruby:*:*

Версия от 2.0.2 (включая) до 3.3.1 (исключая)

EPSS

Процентиль: 84%

0.02072

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-x2xw-hw8g-6773

github

почти 3 года назад

govuk_tech_docs vulnerable to unescaped HTML on search results page