Skip to content
fr Sign in
7.1 High

CVE-2024-32463 phlex is an open source framework for building object-oriented views in Ruby

Description

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.

Affected products and versions

Product Affected versions Fixed in
phlex 1.10 1.10.0 → < 1.10.1 1.10.1
phlex 1.9 1.9.0 → < 1.9.2 1.9.2
phlex 1.8 1.8.0 → < 1.8.3 1.8.3
phlex 1.7 1.7.0 → < 1.7.2 1.7.2
phlex 1.6 1.6.0 → < 1.6.3 1.6.3
phlex 1.5 1.5.0 → < 1.5.3 1.5.3
phlex 1.4 1.4.0 → < 1.4.2 1.4.2
fileutils 1.0.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of phlex

The 3 CVEs of phlex →
CVE-2024-32970 Phlex is a framework for building object-oriented views in Ruby 7.1 High CVE-2024-28199 phlex is an open source framework for building object-oriented views in Ruby 7.1 High
Track this CVE