CVE-2023-23913

MEDIUM

rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2023-23913 has a selected CVSS score of 6.3 (medium).

Description

There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 9, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

rails-ujs

Browse Rails / rails-ujs
CVE List6.1.7.3 to < 6.1.7.3affected
7.0.4.3 to < 7.0.4.3affected
5.1.0 to < 5.1.0unaffected

actionview

Browse RubyGems / actionview
GitHub Advisory5.1.0 to < 6.1.7.3 · Fixed in 6.1.7.3affected
7.0.0 to < 7.0.4.3 · Fixed in 7.0.4.3affected

References

9