« Volver al listado

CVE-2022-22577

Estado: ModificadaMedia (6.1)—

An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Debian — Debian LinuxRubyonrails — Actionpack

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22577",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "https://github.com/rails/rails",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-26T17:15:09.133",
  "references": [
    {
      "url": "https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20221118-0002/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://www.debian.org/security/2023/dsa-5372",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20221118-0002/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2023/dsa-5372",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo XSS en Action Pack versiones posteriores a 5.2.0 incluyéndola y versiones anteriores a 5.2.0, que podría permitir a un atacante omitir el CSP para conseguir respuestas que no sean HTML"
    }
  ],
  "lastModified": "2026-06-17T04:28:37.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rubyonrails:actionpack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4C1538E-C0A5-4682-9ADD-A893487A3FAC",
              "versionEndExcluding": "5.2.7.1",
              "versionStartIncluding": "5.2.0"
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:actionpack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E271278A-9888-4F20-8B9B-C2D3BBC2559C",
              "versionEndExcluding": "6.0.4.8",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:actionpack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C9D5EC2-A38D-4469-BDF6-1723BC77B010",
              "versionEndExcluding": "6.1.5.1",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:actionpack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FD1A084-76ED-4206-B0D0-F032967F3392",
              "versionEndExcluding": "7.0.2.4",
              "versionStartIncluding": "7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}