CVE Feed

    Dashboard / CVE / CVE-2024-39308

    CVE-2024-39308

    RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released).

    Published:Jul 8, 2024
    Last Modified:Nov 21, 2024
    EPS:Jul 8, 2024
    EPSS Score:0.01829
    CVSS Score:5.4

    Affected Products

    Vendor
    Rails Admin Project
    Product
    Rails Admin

    Exploits

    No exploit reference

    References

    https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef
    https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673
    https://github.com/railsadminteam/rails_admin/issues/3686
    https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc
    https://rubygems.org/gems/rails_admin/versions/2.3.0
    https://rubygems.org/gems/rails_admin/versions/3.1.3
    https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef
    https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673
    https://github.com/railsadminteam/rails_admin/issues/3686
    https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc
    https://rubygems.org/gems/rails_admin/versions/2.3.0
    https://rubygems.org/gems/rails_admin/versions/3.1.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High