{"action":"Upgrade actionpack to 6.1.7.4 or later.","affected":[{"fixed":"6.1.7.4","introduced":"0"},{"fixed":"7.0.5.1","introduced":"7.0.0"}],"component":"actionpack","cve_ids":["CVE-2023-28362"],"ecosystem":"RubyGems","epss":0.00333,"exploited":false,"fixed_versions":["6.1.7.4","7.0.5.1"],"ghsa_id":"GHSA-4g8v-vg43-wpgf","id":"tcs_01M5KEGMB4D2XT04Q5JNJ2MHN7","modified_at":"2025-05-05T17:49:20.823550Z","published_at":"2023-06-29T15:03:16Z","references":["https://osv.dev/vulnerability/GHSA-4g8v-vg43-wpgf","https://nvd.nist.gov/vuln/detail/CVE-2023-28362","https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441","https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5","https://github.com/rails/rails/commit/c9ab9b32bcdcfd8bcd55907f6c7b20b4e004cc23","https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132","https://github.com/rails/rails","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml","https://security.netapp.com/advisory/ntap-20250502-0009"],"severity":{"label":"medium","score":4},"sources":[{"source":"osv","source_id":"GHSA-4g8v-vg43-wpgf","url":"https://osv.dev/vulnerability/GHSA-4g8v-vg43-wpgf"}],"summary":"Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to"}