6.1
CVSSv3

CVE-2023-28120

Vulnerability Summary

Two vulnerabilities were discovered in rails, the Ruby based server-side MVC web application framework, which could lead to XSS and DOM based cross-site scripting (CRS). This update also fixes a regression introduced in previous update that may block certain access for applications using development environment. For the stable distribution (bullseye), these problems have been fixed in version 2:6.0.3.7+dfsg-2+deb11u2. We recommend that you upgrade your rails packages. For the detailed security status of rails please refer to its security tracker page at: security-tracker.debian.org/tracker/rails

Vendor Advisories

Debian Bug report logs - #1033262 rails: CVE-2023-28120 Package: src:rails; Maintainer for src:rails is Debian Ruby Team <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 20 Mar 2023 20:12:04 UTC Severity: important Found in version rails/2:617 ...
Synopsis Moderate: Logging Subsystem 565 - Red Hat OpenShift security update Type/Severity Security Advisory: Moderate Topic Logging Subsystem 565 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severi ...
Synopsis Moderate: Logging Subsystem 572 - Red Hat OpenShift security update Type/Severity Security Advisory: Moderate Topic Logging Subsystem 572 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severi ...
Two vulnerabilities were discovered in rails, the Ruby based server-side MVC web application framework, which could lead to XSS and DOM based cross-site scripting (CRS) This update also fixes a regression introduced in previous update that may block certain access for applications using development environment For the stable distribution (bullsey ...
Description<!----> This CVE is under investigation by Red Hat Product Security ...