Advisory details:
ruby_advisory_db / gems/actionview/CVE-2022-27777
| Advisory ID | ruby_advisory_db/gems/actionview/CVE-2022-27777 |
| Aliases |
CVE-2022-27777
GHSA-ch3h-j2vf-95pv |
| Summary | Possible XSS Vulnerability in Action View tag helpers There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777. Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1 ## Impact If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability. Impacted code will look something like this: ``` check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' }) ``` Where the "malicious_input" variable contains untrusted data. All users running an affected release should either upgrade or use one of the workarounds immediately. ## Releases The FIXED releases are available at the normal locations. ## Workarounds Escape the untrusted data before using it as a key for tag helper methods. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 6.1 |
| Reference id | Reference type | URL |
|---|---|---|
| https://groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw |
No exploits are available.
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no known vectors.
There are no SSVC decisions available.