CVE-2023-23913

Published: Jan 9, 2025Modified: Jun 17, 2026Deferred

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (5)

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263

Source: support@hackerone.com

https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468

Source: support@hackerone.com

https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd

Source: support@hackerone.com

https://security.netapp.com/advisory/ntap-20240605-0007/

Source: support@hackerone.com

https://www.debian.org/security/2023/dsa-5389

Source: support@hackerone.com

Timeline

No history available yet.