Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem

MITTEL 6.1CVE-2023-25309 · GHSA-5xq9-h3j2-jxvc · Published 11/05/2023 · updated 09/07/2026

Kurz gesagt

CVE-2023-25309 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in rollout-ui, rollout-ui (fetlife).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.52%, höher als bei 44.5% aller Schwachstellen.
Abhilfe: auf 0.5.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
rollout-ui RubyGems	`< 0.5.3`	`0.5.3`
rollout-ui fetlife	`≤ 0.5`	No fix yet

Description

Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.

NVD description

Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.

References

nvd.nist.gov/vuln/detail/CVE-2023-25309 · ADVISORY
fetlife/rollout-ui#15 · WEB
fetlife/rollout-ui commit 713d9c2 · WEB
cxsecurity.com/issue/WLB-2023050012 · WEB
fetlife/rollout-ui · PACKAGE
fetlife/rollout-ui release v0.5.3 · WEB
rubysec/ruby-advisory-db · WEB
packetstormsecurity.com/files/172185/Rollout-UI-0.5-Cross-Site-Scripting.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free