Cross-site scripting in Ruby on Rails - CVE-2016-6316

Vulnerability identifier: #VU8575

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2016-6316

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1. A remote authenticated attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Ruby on Rails
Debian Linux
Fedora
ror40-rubygem-actionpack (Red Hat package)
rh-ror41-rubygem-actionview (Red Hat package)
rubygem-actionview
rubygem-actioncable
rubygem-actionmailer
rubygem-activejob
rubygem-activemodel
rubygem-activerecord
rubygem-activesupport
rubygem-rails
rubygem-actionpack
rubygem-railties

The vendor has issued the following versions to address this vulnerability: 3.2.22.3, 4.2.7.1, 5.0.0.1.

ror40-rubygem-actionpack (Red Hat package) - addressed in versions 4.0.2-8.el6, 4.0.2-8.el7
rh-ror41-rubygem-actionview (Red Hat package) - addressed in versions 4.1.5-6.el6, 4.1.5-6.el7
rubygem-actionview - addressed in versions 4.2.3-6.fc23, 4.2.5.2-3.fc24, 5.0.0.1-2.fc25
rubygem-actioncable - update to 5.0.0.1-1.fc25
rubygem-actionmailer - update to 5.0.0.1-1.fc25
rubygem-activejob - update to 5.0.0.1-1.fc25
rubygem-activemodel - update to 5.0.0.1-1.fc25
rubygem-activerecord - update to 5.0.0.1-1.fc25
rubygem-activesupport - update to 5.0.0.1-1.fc25
rubygem-rails - update to 5.0.0.1-1.fc25
rubygem-actionpack - update to 5.0.0.1-2.fc25
rubygem-railties - update to 5.0.0.1-2.fc25

• https://github.com/rails/rails/commit/8f544bc447612924a50c37ead085a0ea4c217439
• https://github.com/rails/rails/commit/d40e5f0033329f8269c97d9480749a92817a2968
• https://github.com/rails/rails/commit/f05af91c68debc0230c302aa9031a253f8786b87
• https://github.com/rails/rails/commit/2bcb88c9ce7d6fb1f158f54918eb7f936bd33ce9
• https://github.com/rails/rails/commit/4bcccf5ecd81a6272479537911b7d9760c5be164
• https://github.com/rails/rails/commit/5aabcf25caefbe84f656256a9d3e7fc0c9e14ecc
• https://github.com/rails/rails/commit/efd59ab38231eca1084e85aa990321599308757f

• Cross-site scripting in Ruby on Rails Action View
• Debian update for rails
• Fedora 25 update for rubygem-actioncable, rubygem-actionmailer, rubygem-actionpack, rubygem-actionview, rubygem-activejob, rubygem-activemodel, rubygem-activerecord, rubygem-activesupport, rubygem-rails, rubygem-railties
• Fedora 23 update for rubygem-actionview
• Fedora 24 update for rubygem-actionview
• Red Hat Software Collections update for ror40-rubygem-actionpack
• Red Hat Software Collections update for rh-ror41-rubygem-actionview