Description Preview
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. The vulnerability exists in certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails versions >= 7.1.0 and Nokogiri versions < 1.15.7, or 1.16.x < 1.16.8. An attacker could exploit this vulnerability to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with specific combinations of elements. The issue has been addressed in version 1.6.1.
Overview
This vulnerability, identified as CVE-2024-53985, is a low-severity XSS vulnerability in rails-html-sanitizer 1.6.0. It has a CVSS base score of 2.3, indicating low impact.
Remediation
To remediate this vulnerability, users are advised to update rails-html-sanitizer to version 1.6.1 or later. This fix addresses the XSS vulnerability present in certain configurations of the library.
References
- Advisory: GitHub Security Advisory
- Commit Fix: rails-html-sanitizer Commit b0220b8850d52199a15f83c472d175a4122dd7b1
- Additional Fix: rails-html-sanitizer Commit cd18b0ef00aad1d4a9e1c5d860cd23f80f63c505
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- Finance and InsuranceFinance and Insurance
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- ConstructionConstruction
- Educational ServicesEducational Services
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
