Search for vulnerabilities
Vulnerability details: VCID-eahk-h3gr-bfdb
Vulnerability ID VCID-eahk-h3gr-bfdb
Aliases CVE-2024-53987
GHSA-2x5m-9ch4-qgrr
Summary rails-html-sanitizer: Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
Status Published
Exploitability 0.5
Weighted Severity 3.8
Risk 1.9
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 3.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-53987.json
cvssv3 4.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-53987.json
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00113 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2024-53987
cvssv3.1_qr LOW https://github.com/advisories/GHSA-2x5m-9ch4-qgrr
generic_textual LOW https://github.com/rails/rails-html-sanitizer
cvssv4 2.3 https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
generic_textual LOW https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
ssvc Track https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
cvssv3.1_qr LOW https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
cvssv4 2.3 https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
generic_textual LOW https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
ssvc Track https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
generic_textual LOW https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2024-53987.yml
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2024-53987
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-53987.json
https://api.first.org/data/v1/epss?cve=CVE-2024-53987
https://github.com/rails/rails-html-sanitizer
https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
2330053 https://bugzilla.redhat.com/show_bug.cgi?id=2330053
CVE-2024-53987 https://nvd.nist.gov/vuln/detail/CVE-2024-53987
CVE-2024-53987.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2024-53987.yml
f02ffbb8465e73920b6de0da940f5530f855965e https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
GHSA-2x5m-9ch4-qgrr https://github.com/advisories/GHSA-2x5m-9ch4-qgrr
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-53987.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-53987.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-03T14:33:13Z/ Found at https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-03T14:33:13Z/ Found at https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
Exploit Prediction Scoring System (EPSS)
Percentile 0.10484
EPSS Score 0.00043
Published At Dec. 3, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-12-03T11:12:37.012388+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-53987.json 35.0.0