4.0med
CVE-2023-28362
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
Also known as GHSA-4g8v-vg43-wpgf
Published 3 y ago · modified 4 mo ago · JSON
CVSS
4.0
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 27%
Public exploits
0
none known
Summary
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction (EPSS)
0.33% probability of exploitation in the next 30 days, higher than 27% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.1 | 4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | actionpack | <6.1.7.4 >=7.0.0, <7.0.5.1 | 6.1.7.4 7.0.5.1 |
Affected products
- Rails Action Pack
Classification
- Weakness
- CWE-116 Improper Encoding or Escaping of Output
- Technology feeds
- Ruby on Rails (RSS, critical only)
References
- discuss.rubyonrails.org /t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
- github.com /advisories/GHSA-4g8v-vg43-wpgf
- github.com /rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441
- github.com /rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5
- security.netapp.com /advisory/ntap-20250502-0009/
- nvd.nist.gov /vuln/detail/CVE-2023-28362 · advisory
- github.com /rails/rails/commit/c9ab9b32bcdcfd8bcd55907f6c7b20b4e004cc23 · web
- github.com /rails/rails · package
- github.com /rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml · web
- security.netapp.com /advisory/ntap-20250502-0009 · web
Sources
- CVE List: CVE-2023-28362
- GitHub Advisory: GHSA-4g8v-vg43-wpgf
- NVD: CVE-2023-28362
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.