Log in Start free

Vulnerability · Published Jan 4, 2024 · Assigned by GitHub_M

CVE-2024-21636view_component Cross-site Scripting vulnerability

Medium 6.1

In plain English

A medium-severity cross-site scripting in view_component from ViewComponent. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.5%top 57.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsview_component3.9.0GHSA-wf2x-8w6j-qw37
RubyGemsview_component2.83.0GHSA-wf2x-8w6j-qw37

Affected products (as reported)

VendorProductVersions
ViewComponent view_component >= 3.0.0, < 3.9.0< 2.83.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References