Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2022-22577 Details

An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533	CVE	PatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html	CVE	Mailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20221118-0002/	CVE	Third Party Advisory
https://www.debian.org/security/2023/dsa-5372	CVE
https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533	[email protected]	PatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html	[email protected]	Mailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20221118-0002/	[email protected]	Third Party Advisory
https://www.debian.org/security/2023/dsa-5372	[email protected]

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Product	Versions
rubyonrails actionpack	>= 5.2.0, < 5.2.7.1 >= 6.0.0, < 6.0.4.8 >= 6.1.0, < 6.1.5.1 >= 7.0.0, < 7.0.2.4
CPE cpe:2.3:a:rubyonrails:actionpack::::::ruby::* Remediation No remediation found in references.
debian debian linux	10.0
CPE cpe:2.3:o:debian:debian_linux:10.0:::::::* Remediation No remediation found in references.

9 change records found show changes

QUICK INFO