CVE-2016-6316
Last modified
CVE-2016-6316 is a vulnerability of currently unknown severity. Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.. EPSS estimates a 3.44% chance of exploitation in the next 30 days.
Description
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Rubyonrails | Rails | 3.0.0 | — |
| Rubyonrails | Rails | 3.0.1 | — |
| Rubyonrails | Rails | 3.0.2 | — |
| Rubyonrails | Rails | 3.0.3 | — |
| Rubyonrails | Rails | 3.0.4 | Rc1 |
| Rubyonrails | Rails | 3.0.5 | — |
| Rubyonrails | Rails | 3.0.6 | — |
| Rubyonrails | Rails | 3.0.7 | — |
| Rubyonrails | Rails | 3.0.8 | — |
| Rubyonrails | Rails | 3.0.9 | — |
| Rubyonrails | Rails | 3.0.10 | — |
| Rubyonrails | Rails | 3.0.11 | — |
| Rubyonrails | Rails | 3.0.12 | — |
| Rubyonrails | Rails | 3.0.13 | — |
| Rubyonrails | Rails | 3.0.14 | — |
| Rubyonrails | Rails | 3.0.16 | — |
| Rubyonrails | Rails | 3.0.17 | — |
| Rubyonrails | Rails | 3.0.18 | — |
| Rubyonrails | Rails | 3.0.19 | — |
| Rubyonrails | Rails | 3.0.20 | — |
| Rubyonrails | Rails | 3.1.0 | — |
| Rubyonrails | Rails | 3.1.1 | — |
| Rubyonrails | Rails | 3.1.2 | — |
| Rubyonrails | Rails | 3.1.3 | — |
| Rubyonrails | Rails | 3.1.4 | — |
| Rubyonrails | Rails | 3.1.5 | — |
| Rubyonrails | Rails | 3.1.6 | — |
| Rubyonrails | Rails | 3.1.7 | — |
| Rubyonrails | Rails | 3.1.8 | — |
| Rubyonrails | Rails | 3.1.9 | — |
| Rubyonrails | Rails | 3.1.10 | — |
| Rubyonrails | Rails | 3.1.12 | — |
| Rubyonrails | Rails | 3.2.0 | — |
| Rubyonrails | Rails | 3.2.1 | — |
| Rubyonrails | Rails | 3.2.2 | — |
| Rubyonrails | Rails | 3.2.3 | — |
| Rubyonrails | Rails | 3.2.4 | — |
| Rubyonrails | Rails | 3.2.5 | — |
| Rubyonrails | Rails | 3.2.6 | — |
| Rubyonrails | Rails | 3.2.7 | — |
| Rubyonrails | Rails | 3.2.8 | — |
| Rubyonrails | Rails | 3.2.9 | — |
| Rubyonrails | Rails | 3.2.10 | — |
| Rubyonrails | Rails | 3.2.11 | — |
| Rubyonrails | Rails | 3.2.12 | — |
| Rubyonrails | Rails | 3.2.13 | — |
| Rubyonrails | Rails | 3.2.15 | — |
| Rubyonrails | Rails | 3.2.16 | — |
| Rubyonrails | Rails | 3.2.17 | — |
| Rubyonrails | Rails | 3.2.18 | — |
Showing 50 of 108 affected configurations. See NVD for the full list.
References
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/Release Notes, Vendor Advisory
- http://www.debian.org/security/2016/dsa-3651Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/08/11/3Third Party Advisory
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/Release Notes, Vendor Advisory
- http://www.debian.org/security/2016/dsa-3651Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/08/11/3Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-6316?
How severe is CVE-2016-6316?
How do I fix CVE-2016-6316?
Are you affected by CVE-2016-6316?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST