Vulnerability · Published Jan 9, 2025 · Assigned by hackerone
CVE-2023-28120
Medium 5.3
In plain English
A medium-severity cross-site scripting in ActiveSupport from Rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.9%top 38.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | ruby-activesupport | 7.0.4.3-r0 | ALPINE-CVE-2023-28120 |
| Alpine:v3.21 | ruby-activesupport | 7.0.4.3-r0 | ALPINE-CVE-2023-28120 |
| Alpine:v3.22 | ruby-activesupport | 7.0.4.3-r0 | ALPINE-CVE-2023-28120 |
| Alpine:v3.23 | ruby-activesupport | 7.0.4.3-r0 | ALPINE-CVE-2023-28120 |
| Alpine:v3.24 | ruby-activesupport | 7.0.4.3-r0 | ALPINE-CVE-2023-28120 |
| Debian:12 | rails | 2:6.1.7.3+dfsg-1 | DEBIAN-CVE-2023-28120 |
| Debian:13 | rails | 2:6.1.7.3+dfsg-1 | DEBIAN-CVE-2023-28120 |
| Debian:14 | rails | 2:6.1.7.3+dfsg-1 | DEBIAN-CVE-2023-28120 |
| RubyGems | activesupport | 6.1.7.3 | GHSA-pj73-v5mw-pm9j |
| RubyGems | activesupport | 7.0.4.3 | GHSA-pj73-v5mw-pm9j |
| Ubuntu:24.04:LTS | rails | no fix listed | UBUNTU-CVE-2023-28120 |
| Ubuntu:25.10 | rails | no fix listed | UBUNTU-CVE-2023-28120 |
| Ubuntu:26.04:LTS | rails | no fix listed | UBUNTU-CVE-2023-28120 |
| Ubuntu:26.10 | rails | no fix listed | UBUNTU-CVE-2023-28120 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rails | ActiveSupport | 7.0.4.3 – before 7.0.4.36.1.7.3 – before 6.1.7.3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469
- https://github.com/rails/rails/commit/3cf23c3f891e2e81c977ea4ab83b62bc2a444b70
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPV6PVCX4VDJHLFFT42EXBBSGAWZICOW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZE5W4MH6IE4DV7GELDK6ISCSTFLHKSYO/
- https://security.netapp.com/advisory/ntap-20240202-0006/
- https://www.debian.org/security/2023/dsa-5389