We found results for “”
CVE-2023-28362
Good to know:
Date: March 14, 2023
A possible Cross-Site Scripting (XSS) vulnerability was found in actionpack gem. The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. The vulnerability is fixed in versions 6.1.7.4 and 7.0.5.1.
Language: Ruby
Severity Score
Related Resources (5)
Severity Score
Top Fix
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | NONE |
User Interaction (UI): | REQUIRED |
Scope (S): | CHANGED |
Confidentiality (C): | LOW |
Integrity (I): | LOW |
Availability (A): | NONE |