Описание
Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.
A vulnerability was found in actionpack ruby gem. Applications using the translate method may be susceptible to a cross-site scripting (XSS) attack.
Отчет
The following requirements need to be met in order for an application be vulnerable:
- Use a translation function from a controller, such as not
I18n.t, ortfrom a view - Use a key that ends in
_html - Use a default value where the default value is untrusted and unescaped input
- Send the text to the victim, whether that’s part of a template, or a
rendercall
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp-system-container | Affected | ||
| Red Hat Satellite 6 | rubygem-actionpack | Not affected |
Показывать по
Дополнительная информация
Статус:
4.1 Medium
CVSS3
Связанные уязвимости
Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.
Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.
Rails is a web-application framework. There is a possible XSS vulnerab ...
Rails has possible XSS Vulnerability in Action Controller
Уязвимость программной платформы Ruby on Rails, связанная с неправильной нейтрализацией входных данных во время генерации веб-страницы, позволяющая нарушителю проводить межсайтовый скриптинг
4.1 Medium
CVSS3