Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBjM20tdjI4Ni0yandq
actionview Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Permalink: https://github.com/advisories/GHSA-pc3m-v286-2jwjJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBjM20tdjI4Ni0yandq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 6 years ago
Updated: 6 months ago
CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-pc3m-v286-2jwj, CVE-2016-6316
References:
- https://nvd.nist.gov/vuln/detail/CVE-2016-6316
- https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE
- http://rhn.redhat.com/errata/RHSA-2016-1855.html
- http://rhn.redhat.com/errata/RHSA-2016-1856.html
- http://rhn.redhat.com/errata/RHSA-2016-1857.html
- http://rhn.redhat.com/errata/RHSA-2016-1858.html
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/
- http://www.debian.org/security/2016/dsa-3651
- http://www.openwall.com/lists/oss-security/2016/08/11/3
- https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430
- https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
- https://github.com/advisories/GHSA-pc3m-v286-2jwj
Affected Packages
rubygems:actionview
Dependent packages: 354Dependent repositories: 601,072
Downloads: 477,673,908 total
Affected Version Ranges: = 5.0.0, >= 4.0.0, <= 4.2.7, >= 3.0.0, <= 3.2.22.2
Fixed in: 5.0.0.1, 4.2.7.1, 3.2.22.3
All affected versions: 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8, 4.1.9, 4.1.10, 4.1.11, 4.1.12, 4.1.13, 4.1.14, 4.1.15, 4.1.16, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 5.0.0
All unaffected versions: 4.2.8, 4.2.9, 4.2.10, 4.2.11, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.1.0, 7.1.1, 7.1.2, 7.1.3