CVE-2022-22577
UNKNOWN
Published 2022-05-26T00:00:00
Actions:
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2022-22577. We'll provide specific mitigation strategies based on your environment and risk profile.
No CVSS data available
Description
An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
assigned the CVE identifier CVE-2022-22577.
Versions Affected: >= 5.2.0
Not affected: < 5.2.0
Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
## Impact
CSP headers were only sent along with responses that Rails considered as
"HTML" responses. This left API requests without CSP headers, which could
possibly expose users to XSS attacks.
## Releases
The FIXED releases are available at the normal locations.
## Workarounds
Set a CSP for your API responses manually.
Affected Packages
RubyGems
actionpack
ECOSYSTEM:
≥5.2.0
<5.2.7.1
RubyGems
actionpack
ECOSYSTEM:
≥6.0.0
<6.0.4.8
RubyGems
actionpack
ECOSYSTEM:
≥6.1.0
<6.1.5.1
RubyGems
actionpack
ECOSYSTEM:
≥7.0.0
<7.0.2.4
CVSS Scoring
CVSS Score
5.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Advisory provided by GitHub Security Advisory Database. Published: April 27, 2022, Modified: June 8, 2022
References
Published: 2022-05-26T00:00:00
Last Modified: 2024-08-03T03:14:55.738Z
Copied to clipboard!