« Volver al listado

CVE-2023-30614

Estado: ModificadaMedia (6.1)—

Pay es un motor de pagos para Ruby on Rails 6.0 y superiores. En las versiones anteriores a la 6.3.2, la página de información de pagos de Pay es vulnerable a secuencias de comandos en sitios cruzados (XSS) reflejadas. Un atacante podría crear una URL funcional que muestre un enlace de JavaScript a un usuario de una aplicación Rails que integre Pay. Esta URL podría distribuirse por correo electrónico para dirigirse específicamente a determinadas personas.

Leer descripción completaMostrar menos

Si la aplicación objetivo contiene una funcionalidad para enviar contenido generado por el usuario (como comentarios), el atacante incluso podría distribuir la URL utilizando dicha funcionalidad. Esto se ha corregido en la versión 6.3.2 y superiores. Se recomienda a los usuarios actualizar. No existen soluciones alternativas conocidas para esta vulnerabilidad.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

PAY Project — PAY

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-30614",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-30614",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-05T16:55:33.359711Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pay-rails",
          "product": "pay",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.3.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-04-19T18:15:07.637",
  "references": [
    {
      "url": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pay-rails/pay/commit/5d6283a24062bd272a524ec48415f536a67ad57f",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/pay-rails/pay/security/advisories/GHSA-cqf3-vpx7-rxhw",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    }
  ],
  "lastModified": "2026-06-17T05:55:08.963",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pay_project:pay:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "088D4CFF-C244-4E06-A3C4-667D1CDE88CC",
              "versionEndExcluding": "6.3.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}