CVE-2023-23913
1 advisory.
RubyGems/actionview CVE-2023-23913: medium 6.3, EPSS 0.64%
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
Action: Upgrade actionview to 6.1.7.3 or later.
bundle update actionviewAffected
| introduced | fixed | last affected |
|---|---|---|
| 5.1.0 | 6.1.7.3 | - |
| 7.0.0 | 7.0.4.3 | - |
Fixed versions
| 6.1.7.3 | 7.0.4.3 |
Sources
- osv: GHSA-xp5h-f8jf-rc8q
- https://nvd.nist.gov/vuln/detail/CVE-2023-23913
- https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd
- https://github.com/rails/rails/commit/73009ea59a811b28e8ec2a9c9bc24635aa891214
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263
- https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468
- https://github.com/rails/rails
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2023-23913.yml
- https://security.netapp.com/advisory/ntap-20240605-0007
- https://www.debian.org/security/2023/dsa-5389
CVE-2023-23913 · published · modified · JSON