PT-2021-12714 · Rubygems · Action Pack
Published
2021-01-06
·
Updated
2024-06-15
·
CVE-2020-8264
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
actionpack gem versions 6.0.0 and later
Description:
A possible XSS vulnerability exists in the Actionable Exceptions middleware when an application is running in development mode, allowing an attacker to execute JavaScript in the context of the local application by sending or embedding a specially crafted URL.
Recommendations:
For actionpack gem versions 6.0.0 and later, disable the Actionable Exceptions middleware in the development environment by adding the line
config.middleware.delete ActionDispatch::ActionableExceptions to the config/environment/development.rb file until a patch can be applied.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Action Pack