Kurz gesagt
- CVE-2022-24722 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in view_component, viewcomponent (github).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.1%, höher als bei 65.4% aller Schwachstellen.
- Abhilfe: auf 2.31.2, 2.49.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| view_component RubyGems | ≥ 2.31.0, < 2.31.2≥ 2.32.0, < 2.49.1
| 2.31.22.49.1
|
| viewcomponent | ≥ 2.31.0, < 2.31.2≥ 2.32.0, < 2.49.1
| 2.31.22.49.1
|
Description
This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display.
Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.
Avoid passing user input to the translate function, or sanitize the inputs before passing them.
For more information
If you have any questions or comments about this advisory:
NVD description
VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free