PT-2022-16830 · Unknown · Viewcomponent

Camertron · Published 2022-03-02 · Updated 2022-03-10 · CVE-2022-24722

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ViewComponent versions prior to 2.31.2 ViewComponent versions prior to 2.49.1

Description The issue is related to a cross-site scripting vulnerability in the view component gem, specifically affecting translations. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display.

Recommendations For versions prior to 2.31.2, update to version 2.31.2 or later to fully mitigate the vulnerability. For versions prior to 2.49.1, update to version 2.49.1 or later to fully mitigate the vulnerability. As a temporary workaround, consider avoiding passing user input to the translate function, or sanitize the inputs before passing them.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24722

GHSA-CM9W-C4RJ-R2CF

Affected Products

Viewcomponent

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24722.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/view_component/CVE-2022-24722.yml · Exploit
• https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9 · Patch
• https://osv.dev/vulnerability/CVE-2022-24722 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cm9w-c4rj-r2cf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24722 · Security Note
• https://github.com/github/view_component · Note
• https://github.com/github/view_component/releases/tag/v2.31.2 · Note
• https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf · Note
• https://github.com/github/view_component/releases/tag/v2.49.1 · Note