GHSA-cm9w-c4rj-r2cf

Suggest an improvement
Source
https://github.com/advisories/GHSA-cm9w-c4rj-r2cf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-cm9w-c4rj-r2cf/GHSA-cm9w-c4rj-r2cf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cm9w-c4rj-r2cf
Aliases
Published
2022-03-02T22:24:05Z
Modified
2024-02-16T07:51:13.975898Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component
Details

This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display.

Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the translate function, or sanitize the inputs before passing them.

For more information

If you have any questions or comments about this advisory: * Open an issue in the github/view_component project

Database specific 
{
    "nvd_published_at": "2022-03-02T23:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-02T22:24:05Z"
}
References

Affected packages

RubyGems / view_component

Package

Name
view_component
Purl
pkg:gem/view_component

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.31.0
Fixed
2.31.2

Affected versions

2.*

2.31.0
2.31.1

RubyGems / view_component

Package

Name
view_component
Purl
pkg:gem/view_component

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.32.0
Fixed
2.49.1

Affected versions

2.*

2.32.0
2.33.0
2.34.0
2.35.0
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.43.1
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0