Vulnerability Description
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rubyonrails | Rails | 3.0.0 |
| Rubyonrails | Ruby On Rails | 3.0.4 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2016-1855.html
- http://rhn.redhat.com/errata/RHSA-2016-1856.html
- http://rhn.redhat.com/errata/RHSA-2016-1857.html
- http://rhn.redhat.com/errata/RHSA-2016-1858.html
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-Release NotesVendor Advisory
- http://www.debian.org/security/2016/dsa-3651Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/08/11/3Third Party Advisory
- http://www.securityfocus.com/bid/92430
- https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE
- https://puppet.com/security/cve/cve-2016-6316
- http://rhn.redhat.com/errata/RHSA-2016-1855.html
- http://rhn.redhat.com/errata/RHSA-2016-1856.html
- http://rhn.redhat.com/errata/RHSA-2016-1857.html
- http://rhn.redhat.com/errata/RHSA-2016-1858.html
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-Release NotesVendor Advisory
FAQ
What is CVE-2016-6316?
CVE-2016-6316 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or ...
How severe is CVE-2016-6316?
CVE-2016-6316 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-6316?
Check the references section above for vendor advisories and patch information. Affected products include: Rubyonrails Rails, Rubyonrails Ruby On Rails, Debian Debian Linux.