{"action":"Upgrade activesupport to 6.1.7.5 or later.","affected":[{"fixed":"6.1.7.5","introduced":"5.2.0"},{"fixed":"7.0.7.1","introduced":"7.0.0"}],"component":"activesupport","cve_ids":["CVE-2023-38037"],"ecosystem":"RubyGems","epss":0.00274,"exploited":false,"fixed_versions":["6.1.7.5","7.0.7.1"],"ghsa_id":"GHSA-cr5q-6q9f-rq6q","id":"tcs_01M5KEJVXTD623KDB8ENRKQCYD","modified_at":"2026-09-10T03:49:57.611332921Z","published_at":"2023-08-23T20:36:24Z","references":["https://osv.dev/vulnerability/GHSA-cr5q-6q9f-rq6q","https://nvd.nist.gov/vuln/detail/CVE-2023-38037","https://github.com/rails/rails/commit/a21d6edf35a60383dfa6c4da49e4b1aef5f00731","https://discuss.rubyonrails.org/t/cve-2023-38037-possible-file-disclosure-of-locally-encrypted-files/83544","https://github.com/rails/rails","https://github.com/rails/rails/releases/tag/v7.0.7.1","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2023-38037.yml","https://security.netapp.com/advisory/ntap-20250214-0010"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-cr5q-6q9f-rq6q","url":"https://osv.dev/vulnerability/GHSA-cr5q-6q9f-rq6q"}],"summary":"Active Support Possibly Discloses Locally Encrypted Files"}