Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| 66cabeda2c46c582d19738e1318be8d59584cc5b to before fe76a95b0d252a2d7c25e69498b720c96b243ea2 | fe76a95b0d252a2d7c25e69498b720c96b243ea2 |
Also listed as affected (6)
| |
Description
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.