CVE-2023-28120 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
hackerone	CNA	---				---
CISA-ADP	ADP	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 32%

Debian Releases

Debian Product

Codename

rails

bullseye (security)	2:6.0.3.7+dfsg-2+deb11u2 fixed
bullseye	2:6.0.3.7+dfsg-2+deb11u2 fixed
bookworm	2:6.1.7.3+dfsg-2~deb12u1 fixed
sid	2:6.1.7.3+dfsg-4 fixed
trixie	2:6.1.7.3+dfsg-4 fixed

Ubuntu Releases

Ubuntu Product

Codename

rails

oracular	needs-triage
noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	needs-triage
xenial	needs-triage
trusty	ignored

rails-4.0

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	ignored

ruby-actionpack-3.2

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	ignored

ruby-activemodel-3.2

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	ignored

ruby-activerecord-3.2

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	ignored

ruby-activesupport-3.2

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	ignored

ruby-rails-3.2

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	ignored

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469

https://github.com/rails/rails/commit/3cf23c3f891e2e81c977ea4ab83b62bc2a444b70

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPV6PVCX4VDJHLFFT42EXBBSGAWZICOW/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZE5W4MH6IE4DV7GELDK6ISCSTFLHKSYO/

https://security.netapp.com/advisory/ntap-20240202-0006/

https://www.debian.org/security/2023/dsa-5389