Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 02:55
Type | Values Removed | Values Added |
---|---|---|
References | () http://rhn.redhat.com/errata/RHSA-2016-1855.html - | |
References | () http://rhn.redhat.com/errata/RHSA-2016-1856.html - | |
References | () http://rhn.redhat.com/errata/RHSA-2016-1857.html - | |
References | () http://rhn.redhat.com/errata/RHSA-2016-1858.html - | |
References | () http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/ - Release Notes, Vendor Advisory | |
References | () http://www.debian.org/security/2016/dsa-3651 - Third Party Advisory | |
References | () http://www.openwall.com/lists/oss-security/2016/08/11/3 - Third Party Advisory | |
References | () http://www.securityfocus.com/bid/92430 - | |
References | () https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE - | |
References | () https://puppet.com/security/cve/cve-2016-6316 - |
07 Nov 2023, 02:33
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2016-09-07 19:28
Updated : 2024-11-21 02:55
NVD link : CVE-2016-6316
Mitre link : CVE-2016-6316
CVE.ORG link : CVE-2016-6316
JSON object : View
Products Affected
rubyonrails
- rails
- ruby_on_rails
debian
- debian_linux
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')