PT-2022-7468 · Ruby On Rails+2 · Action Pack+2

Freakyclown · Published 2022-10-26 · Updated 2024-08-28 · CVE-2022-3704

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions actionpack (affected versions not specified)

Description The issue is related to the incorrect neutralization of input data during web page generation, potentially leading to cross-site scripting. It affects the file actionpack/lib/action dispatch/middleware/templates/routes/ table.html.erb. The manipulation can be initiated remotely, but the existence of this vulnerability is still disputed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Improper Neutralization

Weakness Enumeration

CWE-79

CWE-707

Related Identifiers

BDU:2024-06602

BIT-RAILS-2022-3704

CVE-2022-3704

GHSA-9CHR-4FJH-5RGW

Affected Products

Debian

Red Os

Action Pack

References · 21

• 🔥 https://github.com/rails/rails/issues/46244 · Exploit
• https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-3704 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3704 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3704 · Security Note
• https://bdu.fstec.ru/vul/2024-06602 · Security Note
• https://ubuntu.com/security/CVE-2022-3704 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9chr-4fjh-5rgw · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3704 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3704 · Vendor Advisory
• https://github.com/rails/rails · Note
• https://github.com/rails/rails/pull/46269 · Note
• https://github.com/rails/rails/issues/46244#issuecomment-1380875153 · Note
• https://vuldb.com/?id.212319 · Note