CVE-2016-6316

high-risk

Published 2016-09-07

Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.

Do I need to act?

1.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Rails

Affected Vendors

Debian Rubyonrails

References (20)

http://rhn.redhat.com/errata/RHSA-2016-1855.html

http://rhn.redhat.com/errata/RHSA-2016-1856.html

http://rhn.redhat.com/errata/RHSA-2016-1857.html

http://rhn.redhat.com/errata/RHSA-2016-1858.html

Release Notes http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-...

Third Party Advisory http://www.debian.org/security/2016/dsa-3651

Third Party Advisory http://www.openwall.com/lists/oss-security/2016/08/11/3

http://www.securityfocus.com/bid/92430

https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE

https://puppet.com/security/cve/cve-2016-6316