要点
- CVE-2022-24722 は view_component, viewcomponent (github) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 65.4% より高い）。
- 対処：2.31.2, 2.49.1 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| view_component RubyGems | ≥ 2.31.0, < 2.31.2≥ 2.32.0, < 2.49.1
| 2.31.22.49.1
|
| viewcomponent | ≥ 2.31.0, < 2.31.2≥ 2.32.0, < 2.49.1
| 2.31.22.49.1
|
概要
This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display.
Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.
Avoid passing user input to the translate function, or sanitize the inputs before passing them.
For more information
If you have any questions or comments about this advisory:
NVD の説明
VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン