CVE-2023-23913

Description

There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.

Reserved 2023-01-19 | Published 2025-01-09 | Updated 2025-01-09 | Assigner hackerone

Product status

6.1.7.3 before 6.1.7.3
affected

7.0.4.3 before 7.0.4.3
affected

5.1.0 before 5.1.0
unaffected

References

bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263

discuss.rubyonrails.org/...ntenteditable-html-elements/82468

github.com/...ommit/5037a13614d71727af8a175063bcf6ba1a74bdbd

security.netapp.com/advisory/ntap-20240605-0007/

www.debian.org/security/2023/dsa-5389

cve.org (CVE-2023-23913)

nvd.nist.gov (CVE-2023-23913)

Download JSON