CVE-2016-6316 actionview Cross-site Scripting vulnerability
MediumCVSS 6.1
EPSS 3.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionview(RubyGems) | >= 3.0.0, <= 3.2.22.2 | No fix listed |
| rubygems actionview(RubyGems) | >= 4.0.0, <= 4.2.7 | No fix listed |
| rubygems actionview(RubyGems) | = 5.0.0 | No fix listed |
| rubygems actionview(RubyGems) | >= 3.0.0, < 3.2.22.3 | 3.2.22.3 |
| rubygems actionview(RubyGems) | >= 4.0.0, < 4.2.7.1 | 4.2.7.1 |
| rubygems actionview(RubyGems) | = 4.1.0 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.0.beta1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.0.beta2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.0.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.0.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10.rc3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.10.rc4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.11 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.12 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.12.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.13 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.13.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.14 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.14.1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.14.2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.14.rc1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionview(RubyGems) | = 4.1.14.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.15 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.15.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.16 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.16.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.2.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.2.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.2.rc3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.5 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.6 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.6.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.6.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.7 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.7.1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.8 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.9 | No fix listed |
| rubygems actionview(RubyGems) | = 4.1.9.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.0 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.0.beta1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.0.beta2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.0.beta3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.0.beta4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.0.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.0.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.0.rc3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1.rc3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.1.rc4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.3 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.3.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.4 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.4.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.5 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.5.1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.5.2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.5.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.5.rc2 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.6 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.6.rc1 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.7 | No fix listed |
| rubygems actionview(RubyGems) | = 4.2.7.rc1 | No fix listed |
| rubygems actionview(RubyGems) | >= 5.0.0, < 5.0.0.1 | 5.0.0.1 |
| debian/rails(Debian:12) | < 2:4.2.7.1-1 | 2:4.2.7.1-1 |
| debian/rails(Debian:13) | < 2:4.2.7.1-1 | 2:4.2.7.1-1 |
| debian/rails(Debian:14) | < 2:4.2.7.1-1 | 2:4.2.7.1-1 |
| rubyonrails rails | = 3.0.0 | No fix listed |
| rubyonrails rails | = 3.0.0-beta | No fix listed |
| rubyonrails rails | = 3.0.0-beta2 | No fix listed |
| rubyonrails rails | = 3.0.0-beta3 | No fix listed |
| rubyonrails rails | = 3.0.0-beta4 | No fix listed |
| rubyonrails rails | = 3.0.0-rc | No fix listed |
| rubyonrails rails | = 3.0.0-rc2 | No fix listed |
| rubyonrails rails | = 3.0.1 | No fix listed |
| rubyonrails rails | = 3.0.2 | No fix listed |
| rubyonrails rails | = 3.0.3 | No fix listed |
| rubyonrails rails | = 3.0.4-rc1 | No fix listed |
| rubyonrails rails | = 3.0.5 | No fix listed |
| rubyonrails rails | = 3.0.5-rc1 | No fix listed |
| rubyonrails rails | = 3.0.6 | No fix listed |
| rubyonrails rails | = 3.0.6-rc1 | No fix listed |
| rubyonrails rails | = 3.0.6-rc2 | No fix listed |
| rubyonrails rails | = 3.0.7 | No fix listed |
| rubyonrails rails | = 3.0.7-rc1 | No fix listed |
| rubyonrails rails | = 3.0.7-rc2 | No fix listed |
| rubyonrails rails | = 3.0.8 | No fix listed |
| rubyonrails rails | = 3.0.8-rc1 | No fix listed |
| rubyonrails rails | = 3.0.8-rc2 | No fix listed |
| rubyonrails rails | = 3.0.8-rc3 | No fix listed |
| rubyonrails rails | = 3.0.8-rc4 | No fix listed |
| rubyonrails rails | = 3.0.9 | No fix listed |
| rubyonrails rails | = 3.0.9-rc1 | No fix listed |
| rubyonrails rails | = 3.0.9-rc2 | No fix listed |
| rubyonrails rails | = 3.0.9-rc3 | No fix listed |
| rubyonrails rails | = 3.0.9-rc4 | No fix listed |
| rubyonrails rails | = 3.0.9-rc5 | No fix listed |
| rubyonrails rails | = 3.0.10 | No fix listed |
| rubyonrails rails | = 3.0.10-rc1 | No fix listed |
| rubyonrails rails | = 3.0.11 | No fix listed |
| rubyonrails rails | = 3.0.12 | No fix listed |
| rubyonrails rails | = 3.0.12-rc1 | No fix listed |
| rubyonrails rails | = 3.0.13 | No fix listed |
| rubyonrails rails | = 3.0.13-rc1 | No fix listed |
| rubyonrails rails | = 3.0.14 | No fix listed |
| rubyonrails rails | = 3.0.16 | No fix listed |
| rubyonrails rails | = 3.0.17 | No fix listed |
| rubyonrails rails | = 3.0.18 | No fix listed |
| rubyonrails rails | = 3.0.19 | No fix listed |
| rubyonrails rails | = 3.0.20 | No fix listed |
| rubyonrails rails | = 3.1.0 | No fix listed |
| rubyonrails rails | = 3.1.0-beta1 | No fix listed |
| rubyonrails rails | = 3.1.0-rc1 | No fix listed |
| rubyonrails rails | = 3.1.0-rc2 | No fix listed |
| rubyonrails rails | = 3.1.0-rc3 | No fix listed |
| rubyonrails rails | = 3.1.0-rc4 | No fix listed |
| rubyonrails rails | = 3.1.0-rc5 | No fix listed |
| rubyonrails rails | = 3.1.0-rc6 | No fix listed |
| rubyonrails rails | = 3.1.0-rc7 | No fix listed |
| rubyonrails rails | = 3.1.0-rc8 | No fix listed |
| rubyonrails rails | = 3.1.1 | No fix listed |
| rubyonrails rails | = 3.1.1-rc1 | No fix listed |
| rubyonrails rails | = 3.1.1-rc2 | No fix listed |
| rubyonrails rails | = 3.1.1-rc3 | No fix listed |
| rubyonrails rails | = 3.1.2 | No fix listed |
| rubyonrails rails | = 3.1.2-rc1 | No fix listed |
| rubyonrails rails | = 3.1.2-rc2 | No fix listed |
| rubyonrails rails | = 3.1.3 | No fix listed |
| rubyonrails rails | = 3.1.4 | No fix listed |
| rubyonrails rails | = 3.1.4-rc1 | No fix listed |
| rubyonrails rails | = 3.1.5 | No fix listed |
| rubyonrails rails | = 3.1.5-rc1 | No fix listed |
| rubyonrails rails | = 3.1.6 | No fix listed |
| rubyonrails rails | = 3.1.7 | No fix listed |
| rubyonrails rails | = 3.1.8 | No fix listed |
| rubyonrails rails | = 3.1.9 | No fix listed |
| rubyonrails rails | = 3.1.10 | No fix listed |
| rubyonrails rails | = 3.1.12 | No fix listed |
| rubyonrails rails | = 3.2.0 | No fix listed |
| rubyonrails rails | = 3.2.0-rc1 | No fix listed |
| rubyonrails rails | = 3.2.0-rc2 | No fix listed |
| rubyonrails rails | = 3.2.1 | No fix listed |
| rubyonrails rails | = 3.2.2 | No fix listed |
| rubyonrails rails | = 3.2.2-rc1 | No fix listed |
| rubyonrails rails | = 3.2.3 | No fix listed |
| rubyonrails rails | = 3.2.3-rc1 | No fix listed |
| rubyonrails rails | = 3.2.3-rc2 | No fix listed |
| rubyonrails rails | = 3.2.4 | No fix listed |
| rubyonrails rails | = 3.2.4-rc1 | No fix listed |
| rubyonrails rails | = 3.2.5 | No fix listed |
| rubyonrails rails | = 3.2.6 | No fix listed |
| rubyonrails rails | = 3.2.7 | No fix listed |
| rubyonrails rails | = 3.2.7-rc1 | No fix listed |
| rubyonrails rails | = 3.2.8 | No fix listed |
| rubyonrails rails | = 3.2.8-rc1 | No fix listed |
| rubyonrails rails | = 3.2.8-rc2 | No fix listed |
| rubyonrails rails | = 3.2.9 | No fix listed |
| rubyonrails rails | = 3.2.9-rc1 | No fix listed |
| rubyonrails rails | = 3.2.9-rc2 | No fix listed |
| rubyonrails rails | = 3.2.9-rc3 | No fix listed |
| rubyonrails rails | = 3.2.10 | No fix listed |
| rubyonrails rails | = 3.2.11 | No fix listed |
| rubyonrails rails | = 3.2.12 | No fix listed |
| rubyonrails rails | = 3.2.13 | No fix listed |
| rubyonrails rails | = 3.2.13-rc1 | No fix listed |
| rubyonrails rails | = 3.2.13-rc2 | No fix listed |
| rubyonrails rails | = 3.2.15 | No fix listed |
| rubyonrails rails | = 3.2.15-rc3 | No fix listed |
| rubyonrails rails | = 3.2.16 | No fix listed |
| rubyonrails rails | = 3.2.17 | No fix listed |
| rubyonrails rails | = 3.2.18 | No fix listed |
| rubyonrails rails | = 3.2.21 | No fix listed |
| rubyonrails rails | = 3.2.22.2 | No fix listed |
| rubyonrails rails | = 4.0.0 | No fix listed |
| rubyonrails rails | = 4.0.0-beta | No fix listed |
| rubyonrails rails | = 4.0.0-rc1 | No fix listed |
| rubyonrails rails | = 4.0.0-rc2 | No fix listed |
| rubyonrails rails | = 4.0.1 | No fix listed |
| rubyonrails rails | = 4.0.1-rc1 | No fix listed |
| rubyonrails rails | = 4.0.1-rc2 | No fix listed |
| rubyonrails rails | = 4.0.1-rc3 | No fix listed |
| rubyonrails rails | = 4.0.1-rc4 | No fix listed |
| rubyonrails rails | = 4.0.2 | No fix listed |
| rubyonrails rails | = 4.0.3 | No fix listed |
| rubyonrails rails | = 4.0.4 | No fix listed |
| rubyonrails rails | = 4.0.4-rc1 | No fix listed |
| rubyonrails rails | = 4.0.5 | No fix listed |
| rubyonrails rails | = 4.0.6 | No fix listed |
| rubyonrails rails | = 4.0.6-rc1 | No fix listed |
| rubyonrails rails | = 4.0.6-rc2 | No fix listed |
| rubyonrails rails | = 4.0.6-rc3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View mailing-list
- RHSA-2016:1855 vendor-advisory
- RHSA-2016:1856 vendor-advisory
- RHSA-2016:1857 vendor-advisory
- RHSA-2016:1858 vendor-advisory
- weblog.rubyonrails.org release-notes vendor-advisory
- DSA-3651 third-party-advisory vendor-advisory
- [oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View mailing-list third-party-advisory
- web.archive.org
- web.archive.org
- github.com exploit
- github.com
- Debian Security Tracker CVE-2016-6316 vendor-advisory
- 92430 vdb-entry
- puppet.com
- bugs.debian.org issue-tracking