GHSA-35mm-cc6r-8fjp
Cross-site scripting in actionpack
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2020-8264
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware. Workarounds ----------- Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: `config.middleware.delete ActionDispatch::ActionableExceptions`
Paquets affectés
| Paquet | Versions |
|---|---|
| RubyGems · actionpack | introduced 6.0.0, fixed 6.0.3.4 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2020-8264 ADVISORY
- https://hackerone.com/reports/904059 WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8264.yml WEB
- https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk WEB
- https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |