PT-2022-3569 · Unknown+4 · Action View+4
Álvaro Martín Fraguas
·
Published
2022-04-27
·
Updated
2025-09-29
·
CVE-2022-27777
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Action View tag helpers versions prior to 5.2.7.1
Action View tag helpers versions prior to 6.0.4.8
Action View tag helpers versions prior to 6.1.5.1
Action View tag helpers versions prior to 7.0.2.4
Description
A XSS vulnerability exists in Action View tag helpers due to insufficient protection of web page structure. This allows an attacker to inject content if they can control input into specific attributes. The issue arises when untrusted input is passed as hash keys for tag attributes, potentially leading to improper escaping and XSS attacks. For example, in code like
check box tag('thename', 'thevalue', false, aria: { malicious input => 'thevalueofaria' }), if the malicious input variable contains untrusted data, it may lead to an XSS vulnerability.Recommendations
For versions prior to 5.2.7.1, upgrade to version 5.2.7.1 or later.
For versions prior to 6.0.4.8, upgrade to version 6.0.4.8 or later.
For versions prior to 6.1.5.1, upgrade to version 6.1.5.1 or later.
For versions prior to 7.0.2.4, upgrade to version 7.0.2.4 or later.
As a temporary workaround, escape the untrusted data before using it as a key for tag helper methods.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Action View
Astra Linux
Rocky Linux
Suse