Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| c15ee6e7b5065db3c46afa1f025b8e45f443604e to before 3cf23c3f891e2e81c977ea4ab83b62bc2a444b70 | 3cf23c3f891e2e81c977ea4ab83b62bc2a444b70 |
Also listed as affected (2)
| |
Description
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
References
- Webdiscuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469 ↗
- Weblists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPV6PVCX4VDJHLFFT42EXBBSGAWZICOW/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZE5W4MH6IE4DV7GELDK6ISCSTFLHKSYO/ ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28120.json ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-28120 ↗
- Advisorysecurity.netapp.com/advisory/ntap-20240202-0006/ ↗
- Advisorywww.debian.org/security/2023/dsa-5389 ↗
- Fixgithub.com/rails/rails/commit/3cf23c3f891e2e81c977ea4ab83b62bc2a444b70 ↗