High WID-SEC-2024-3581 5 CVEs

Ruby on Rails: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Dec 2, 2024 · Updated Dec 2, 2024 · de-DE

Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen im Ruby on Rails html-sanitizer ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.

Vulnerabilities 5

Low 2.3

CVE-2024-53985

Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8.…

rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Ubuntu RubyGems

Dec 2, 2024
Low 2.3

CVE-2024-53986

Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain…

rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Ubuntu RubyGems

Dec 2, 2024
Low 2.3

CVE-2024-53987

Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain…

rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Ubuntu RubyGems

Dec 2, 2024
Low 2.3

CVE-2024-53988

Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain…

rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Ubuntu RubyGems

Dec 2, 2024
Low 2.3

CVE-2024-53989

Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain…

rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Ubuntu RubyGems

Dec 2, 2024

Revision history

2024-12-02 #1
Initiale Fassung

References

Ruby on Rails Security Announcements vom 2024-12-02
https://discuss.rubyonrails.org/t/rails-html-sanitizer-v1-6-1-addresses-multiple-cves/88092