Vulnerability advisory

GHSA-pc3m-v286-2jwj

actionview Cross-site Scripting vulnerability

Published Oct 24, 2017Updated Feb 20, 2024OSV record ↗

Also known as CVE-2016-6316

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

actionview RubyGems

All actionview advisories →

Affected	Fixed in
`3.0.0` to before 3.2.22.3	`3.2.22.3`Advisories →
`4.0.0` to before 4.2.7.1	`4.2.7.1`Advisories →
Also listed as affected (67) `4.1.0` `4.1.0.beta1` `4.1.0.beta2` `4.1.0.rc1` `4.1.0.rc2` `4.1.1` `4.1.10` `4.1.10.rc1` `4.1.10.rc2` `4.1.10.rc3` `4.1.10.rc4` `4.1.11` `4.1.12` `4.1.12.rc1` `4.1.13` `4.1.13.rc1` `4.1.14` `4.1.14.1` `4.1.14.2` `4.1.14.rc1` `4.1.14.rc2` `4.1.15` `4.1.15.rc1` `4.1.16` `4.1.16.rc1` `4.1.2` `4.1.2.rc1` `4.1.2.rc2` `4.1.2.rc3` `4.1.3` `4.1.4` `4.1.5` `4.1.6` `4.1.6.rc1` `4.1.6.rc2` `4.1.7` `4.1.7.1` `4.1.8` `4.1.9` `4.1.9.rc1` `4.2.0` `4.2.0.beta1` `4.2.0.beta2` `4.2.0.beta3` `4.2.0.beta4` `4.2.0.rc1` `4.2.0.rc2` `4.2.0.rc3` `4.2.1` `4.2.1.rc1` `4.2.1.rc2` `4.2.1.rc3` `4.2.1.rc4` `4.2.2` `4.2.3` `4.2.3.rc1` `4.2.4` `4.2.4.rc1` `4.2.5` `4.2.5.1` `4.2.5.2` `4.2.5.rc1` `4.2.5.rc2` `4.2.6` `4.2.6.rc1` `4.2.7` `4.2.7.rc1`
`5.0.0` to before 5.0.0.1	`5.0.0.1`Advisories →
Also listed as affected (1) `5.0.0`

Description

Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.

GHSA-pc3m-v286-2jwj

Affected versions

actionview RubyGems

Description

References