Cross-site scripting in Ruby on Rails - CVE-2023-28362

Vulnerability identifier: #VU77734

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2023-28362

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the redirect_to method. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Ruby on Rails
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server 15 SP1 Business Critical Linux
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
openSUSE Leap
openEuler
IBM Cloud Pak for Watson AIOps
ruby2.1-rubygem-actionpack-4_2
ruby2.5-rubygem-actionpack-5_1
ruby2.5-rubygem-actionpack-doc-5_1
rubygem-actionpack
rubygem-actionpack-doc
IBM License Metric Tool

Install updates from vendor's website.

Ruby on Rails - addressed in versions 6.1.7.4, 7.0.5.1
IBM Cloud Pak for Watson AIOps - update to 4.1.1
ruby2.1-rubygem-actionpack-4_2 - update to 4.2.9-7.18.1
ruby2.5-rubygem-actionpack-5_1 - update to 5.1.4-150000.3.18.1
ruby2.5-rubygem-actionpack-doc-5_1 - update to 5.1.4-150000.3.18.1
rubygem-actionpack - update to 6.1.4.1-7
rubygem-actionpack-doc - update to 6.1.4.1-7
IBM License Metric Tool - update to 9.2.33

• https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132

• Cross-site scripting in Ruby on Rails
• SUSE update for rubygem-actionpack-5_1
• SUSE update for rubygem-actionpack-4_2
• Cross-site scripting in IBM License Metric Tool
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• openEuler 22.03 LTS SP1 update for rubygem-actionpack