github.com
https://github.com/rails/rails CVE-2024-32464
ActionText ContentAttachment can Contain Unsanitized HTML
Description
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 31, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
railsBrowse rails / rails | CVE List | >= 7.1.0, < 7.1.3.4 | affected |
| = 7.2.0.beta1 | affected | ||
actiontextBrowse RubyGems / actiontext | GitHub Advisory | 7.1.0 to < 7.1.3.4 · Fixed in 7.1.3.4 | affected |
| 7.2.0.beta1 | affected | ||
| 7.2.0.beta1 to < 7.2.0.beta2 · Fixed in 7.2.0.beta2 | affected |
References
5github.com
https://github.com/rails/rails/commit/e215bf3360e6dfe1497c1503a495e384ed6b0995 github.comConfirmation
https://github.com/rails/rails/security/advisories/GHSA-prjp-h48f-jgf6 github.com
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-32464.yml nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-32464