CVE-2024-26143

CWE-79 — Cross-site Scripting (XSS)8 documents7 sources
Severity
6.1MEDIUM
EPSS
2.1%
top 16.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Rubyonrails RailsRails Rails
Timeline
PublishedFeb 27
Latest updateSep 25

Description

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶RubyGemsrails7.0.0 — 7.0.8.1+1
▶RubyGemsactionpack7.0.0 — 7.0.8.1+1
▶NVDrubyonrails/rails7.0.0 — 7.0.8.1+1
▶CVEListV5rails/rails>= 7.0.0, < 7.0.8.1, >= 7.1.0, < 7.1.3.1+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Rails has possible XSS Vulnerability in Action Controller↗2024-02-27
▶
GHSA
Rails has possible XSS Vulnerability in Action Controller↗2024-02-27
▶
CVEList
Rails Possible XSS Vulnerability in Action Controller↗2024-02-27
▶
OSV
CVE-2024-26143: Rails is a web-application framework↗2024-02-27
▶

📋Vendor Advisories

2
Red Hat
rubygem-actionpack: Possible XSS on translation helpers↗2024-02-24
▶
Debian
CVE-2024-26143: rails - Rails is a web-application framework. There is a possible XSS vulnerability when...↗2024
▶

💬Community

1
HackerOne
Possible XSS Vulnerability in Action Controller↗2024-09-25
▶