Skip to content
OpenAdvisories
Medium · 6.1 CVE-2020-8264 EUVD-2021-0742GHSA-35mm-cc6r-8fjp

Cross-site scripting in actionpack

Published Jan 6, 2021 · Updated Aug 4, 2024 · Assigned by hackerone

Package: actionpack Package: rails Ecosystem: Debian Ecosystem: RubyGems

Description

In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.

Affected products

VendorProductAffectedFixed
— https://github.com/rails/rails 6.0.3.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:6.0.3.4+dfsg-1 —
Debian 13 rails 2:6.0.3.4+dfsg-1 —
Debian 12 rails 2:6.0.3.4+dfsg-1 —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rails-6.0 +12 6.0.4.4-1.1 openSUSE-SU-2024:11832-1, openSUSE-SU-2024:11831-1, openSUSE-SU-2024:11828-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems actionpack >= 6.0.0, < 6.0.3.4 6.0.3.4 GHSA-35mm-cc6r-8fjp

Advisories 13

References