Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
No history.
Information
Published : 2016-09-07 19:28
Updated : 2023-11-07 02:33
NVD link : CVE-2016-6316
Mitre link : CVE-2016-6316
CVE.ORG link : CVE-2016-6316
JSON object : View
Products Affected
debian
- debian_linux
rubyonrails
- rails
- ruby_on_rails
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')