7.1
Élevée
CVE-2024-32463 phlex is an open source framework for building object-oriented views in Ruby
Description
phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| phlex 1.10 | 1.10.0 → < 1.10.1 | 1.10.1 |
| phlex 1.9 | 1.9.0 → < 1.9.2 | 1.9.2 |
| phlex 1.8 | 1.8.0 → < 1.8.3 | 1.8.3 |
| phlex 1.7 | 1.7.0 → < 1.7.2 | 1.7.2 |
| phlex 1.6 | 1.6.0 → < 1.6.3 | 1.6.3 |
| phlex 1.5 | 1.5.0 → < 1.5.3 | 1.5.3 |
| phlex 1.4 | 1.4.0 → < 1.4.2 | 1.4.2 |
| fileutils | 1.0.0 | Pas de correctif indiqué |
Références
- github.com github.com
- github.com github.com
- developer.mozilla.org developer.mozilla.org
- developer.mozilla.org developer.mozilla.org
Chronologie
- Publiée
- Dernière modification