CVE-2024-32463

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-32463
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32463.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32463
Aliases
Published
2024-04-17T15:29:14.463Z
Modified
2025-12-05T04:19:40.980822Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
Summary
phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
Details

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an <a> tag could be bypassed with tab \t or newline \n characters between the characters of the protocol, e.g. java\tscript:. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow unsafe-inline would effectively prevent this vulnerability from being exploited.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32463.json"
}
References

Affected packages

Git / github.com/phlex-ruby/phlex

Affected ranges

Type
GIT
Repo
https://github.com/phlex-ruby/phlex
Events
Introduced
215dec39f43278b1ef6761203a484602276c4f3d
Fixed
61c03034c8c8f3e03a719b1783ee0d298442f232
Database specific 
{
    "versions": [
        {
            "introduced": "1.10.0"
        },
        {
            "fixed": "1.10.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/phlex-ruby/phlex
Events
Introduced
5f0c9b068b50cb0f5fb8239fb0138539ff09eaa8
Fixed
169dfbfb803a96080bfaae525f4b7c23f0e6c107
Database specific 
{
    "versions": [
        {
            "introduced": "1.9.0"
        },
        {
            "fixed": "1.9.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/phlex-ruby/phlex
Events
Introduced
821834048320ed36f2e36d4be88e67e081b9b224
Fixed
57f2982a2e3350c9bd58e92bdb98820ed0e1cb4f
Database specific 
{
    "versions": [
        {
            "introduced": "1.8.0"
        },
        {
            "fixed": "1.8.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/phlex-ruby/phlex
Events
Introduced
fc5b52dfb777999709c40edad7c23395af4621a5
Fixed
7d53c220878f623081389780f9c3ec0c30bc44f8
Database specific 
{
    "versions": [
        {
            "introduced": "1.7.0"
        },
        {
            "fixed": "1.7.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/phlex-ruby/phlex
Events
Introduced
41ed20fb52ec121c7ea076953df4d54d909ddd0a
Fixed
1c9f72a0ab5bc3006097400ed11de8413d99457b
Database specific 
{
    "versions": [
        {
            "introduced": "1.6.0"
        },
        {
            "fixed": "1.6.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/phlex-ruby/phlex
Events
Introduced
c00178aeda556f8799af08ace27ceada99544bd3
Fixed
175f67a4cd11609935f73cafdc923dea45f99ac7
Database specific 
{
    "versions": [
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "1.5.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/phlex-ruby/phlex
Events
Introduced
a54939c318ffaf6ee7f1d3199f8e07d9c6c87605
Fixed
c4056b48f2f4ece5f49d03673ecb17bdf47032c3
Database specific 
{
    "versions": [
        {
            "introduced": "1.4.0"
        },
        {
            "fixed": "1.4.2"
        }
    ]
}

Affected versions

1.*

1.10.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32463.json"

Git / github.com/yippee-fun/phlex

Affected ranges

Type
GIT
Repo
https://github.com/yippee-fun/phlex
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9e3f5b980655817993682e409cbda72956d865cb

Affected versions

0.*

0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.4.0
0.5.0
0.5.1
0.5.2
0.5.3

1.*

1.0.0
1.0.0.rc1
1.0.0.rc2
1.1.0
1.10.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.8.1
1.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32463.json"