medium6.1
CVE-2016-6316
actionview Cross-site Scripting vulnerability
Impact
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | actionview | >= 3.0.0, <= 3.2.22.2 | 3.2.22.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rubyonrails | Rails | Versions 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 |
| Rubyonrails | Ruby On Rails | Versions 3.0.4, 3.2.14, 3.2.15, 3.2.19, 3.2.20, 3.2.22 |
| Debian | Debian Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://rhn.redhat.com/errata/RHSA-2016-1855.html
- http://rhn.redhat.com/errata/RHSA-2016-1856.html
- http://rhn.redhat.com/errata/RHSA-2016-1857.html
- http://rhn.redhat.com/errata/RHSA-2016-1858.html
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/
- http://www.debian.org/security/2016/dsa-3651
- http://www.openwall.com/lists/oss-security/2016/08/11/3
- http://www.securityfocus.com/bid/92430
- https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE
- https://puppet.com/security/cve/cve-2016-6316
- https://github.com/advisories/GHSA-pc3m-v286-2jwj
- https://nvd.nist.gov/vuln/detail/CVE-2016-6316
- https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE
- https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430
- https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk