Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem

MOYENNE 6.1CVE-2023-25309 · GHSA-5xq9-h3j2-jxvc · Published 11/05/2023 · updated 09/07/2026

En bref

CVE-2023-25309 est une vulnérabilité MOYENNE (CVSS 6.1) touchant rollout-ui, rollout-ui (fetlife).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.52%, plus élevée que 44.5% des vulnérabilités.
Correctif : mettre à jour vers 0.5.3 ou plus récent.

Package	Affected versions	Patched versions
rollout-ui RubyGems	`< 0.5.3`	`0.5.3`
rollout-ui fetlife	`≤ 0.5`	No fix yet

Description

Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.

NVD description

Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality.

References

nvd.nist.gov/vuln/detail/CVE-2023-25309 · ADVISORY
fetlife/rollout-ui#15 · WEB
fetlife/rollout-ui commit 713d9c2 · WEB
cxsecurity.com/issue/WLB-2023050012 · WEB
fetlife/rollout-ui · PACKAGE
fetlife/rollout-ui release v0.5.3 · WEB
rubysec/ruby-advisory-db · WEB
packetstormsecurity.com/files/172185/Rollout-UI-0.5-Cross-Site-Scripting.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free