6.3 Medium

CVE-2023-23913 There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target…

Description

There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.

Affected products and versions

Product	Affected versions	Fixed in
rails-ujs 7.0	earliest → < 7.0.4.3	7.0.4.3
rails-ujs 6.1	earliest → < 6.1.7.3	6.1.7.3
rails-ujs 5.1	earliest → < 5.1.0	5.1.0

References

bugs.debian.org bugs.debian.org
discuss.rubyonrails.org discuss.rubyonrails.org
github.com github.com
security.netapp.com security.netapp.com
www.debian.org www.debian.org

Timeline

Published January 9, 2025
Last modified January 9, 2025

Track this CVE