System	Score	Found at
cvssv2		https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionpack/CVE-2022-22577.yml
cvssv3.1		https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionpack/CVE-2022-22577.yml

Reference id	Reference type	URL
		https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533
		https://github.com/rails/rails/pull/44635
		https://groups.google.com/g/ruby-security-ann/c/NuFRKaN5swI
		https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
CVE-2022-22577		https://nvd.nist.gov/vuln/detail/CVE-2022-22577
CVE-2022-22577.YML		https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-22577.yml
GHSA-mm33-5vfq-3mm3		https://github.com/advisories/GHSA-mm33-5vfq-3mm3

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionpack/CVE-2022-22577.yml

Exploitability (E)	Access Vector (AV)	Access Complexity (AC)	Authentication (Au)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
high functional unproven proof_of_concept not_defined	local adjacent_network network	high medium low	multiple single none	none partial complete	none partial complete	none partial complete

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionpack/CVE-2022-22577.yml

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

There are no SSVC decisions available.