CVE-2024-53989 LOW

CVE-2024-53989: Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

Vendor Rails

Product rails-html-sanitizer

Weakness CWE-79 · XSS

Published December 2, 2024

Last update December 3, 2024

View on NVD All CVEs

CVSS base score

2.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

Description

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags for the the "noscript" element. This vulnerability is fixed in 1.6.1.

Key dates

Disclosure timeline

December 2, 2024 CVE published

December 3, 2024 Record updated