GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-32463 (GCVE-0-2024-32463)

Vulnerability from cvelistv5 – Published: 2024-04-17 15:29 – Updated: 2024-08-02 02:13
VLAI
Title
phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
Summary
phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-23 18:58 UTC
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version CPE status
phlex-ruby phlex Affected: >= 1.10.0, < 1.10.1
Affected: >= 1.9.0, < 1.9.2
Affected: >= 1.8.0, < 1.8.3
Affected: >= 1.7.0, < 1.7.2
Affected: >= 1.6.0, < 1.6.3
Affected: >= 1.5.0, < 1.5.3
Affected: >= 1.4.0, < 1.4.2
guessed Create a notification for this product.
ruby fileutils Affected: 1.0.0
    cpe:2.3:a:ruby:fileutils:1.0.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ruby:fileutils:1.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fileutils",
            "vendor": "ruby",
            "versions": [
              {
                "status": "affected",
                "version": "1.0.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T18:58:58.573841Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:51:21.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:13:39.303Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
          },
          {
            "name": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
          },
          {
            "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
          },
          {
            "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "phlex",
          "vendor": "phlex-ruby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0, \u003c 1.9.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0, \u003c 1.8.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.0, \u003c 1.6.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.0, \u003c 1.5.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.4.0, \u003c 1.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `\u003ca\u003e` tag could be bypassed with tab `\\t` or newline `\\n` characters between the characters of the protocol, e.g. `java\\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-17T15:29:14.463Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
        },
        {
          "name": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
        },
        {
          "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
        },
        {
          "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
        }
      ],
      "source": {
        "advisory": "GHSA-g7xq-xv8c-h98c",
        "discovery": "UNKNOWN"
      },
      "title": "phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `\u003ca\u003e` tags"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-32463",
    "datePublished": "2024-04-17T15:29:14.463Z",
    "dateReserved": "2024-04-12T19:41:51.164Z",
    "dateUpdated": "2024-08-02T02:13:39.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-32463",
      "date": "2026-09-17",
      "epss": "0.00575",
      "percentile": "0.4601"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `\u003ca\u003e` tag could be bypassed with tab `\\t` or newline `\\n` characters between the characters of the protocol, e.g. `java\\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited."
        },
        {
          "lang": "es",
          "value": "Phlex es un framework de c\u00f3digo abierto para crear vistas orientadas a objetos en Ruby. Existe una posible vulnerabilidad de cross-site scripting (XSS) que puede explotarse mediante datos de usuario creados con fines malintencionados. El filtro para detectar y evitar el uso del esquema de URL `javascript:` en el atributo `href` de una etiqueta `\u003ca rel=\"nofollow\"\u003e` podr\u00eda omitirse con tabulaciones `\\t` o caracteres de nueva l\u00ednea `\\n` entre los caracteres de el protocolo, por ejemplo `java\\tscript:`. Esta vulnerabilidad se solucion\u00f3 en 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3 y 1.4.2. Configurar una pol\u00edtica de seguridad de contenido que no permita \"inseguro en l\u00ednea\" evitar\u00eda efectivamente que se aproveche esta vulnerabilidad.\u003c/a\u003e"
        }
      ],
      "id": "CVE-2024-32463",
      "lastModified": "2024-11-21T09:14:57.993",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 4.2,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-04-17T16:15:09.243",
      "references": [
        {
          "source": "security-advisories@github.com",
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "phlex",
                "vendor": "phlex-ruby",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.10.0, \u003c 1.10.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.9.0, \u003c 1.9.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.8.0, \u003c 1.8.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.7.0, \u003c 1.7.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.6.0, \u003c 1.6.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.5.0, \u003c 1.5.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.4.0, \u003c 1.4.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:ruby:fileutils:1.0.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "fileutils",
                "vendor": "ruby",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.0.0"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `\u003ca\u003e` tag could be bypassed with tab `\\t` or newline `\\n` characters between the characters of the protocol, e.g. `java\\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited."
          },
          {
            "lang": "es",
            "value": "Phlex es un framework de c\u00f3digo abierto para crear vistas orientadas a objetos en Ruby. Existe una posible vulnerabilidad de cross-site scripting (XSS) que puede explotarse mediante datos de usuario creados con fines malintencionados. El filtro para detectar y evitar el uso del esquema de URL `javascript:` en el atributo `href` de una etiqueta `\u003ca rel=\"nofollow\"\u003e` podr\u00eda omitirse con tabulaciones `\\t` o caracteres de nueva l\u00ednea `\\n` entre los caracteres de el protocolo, por ejemplo `java\\tscript:`. Esta vulnerabilidad se solucion\u00f3 en 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3 y 1.4.2. Configurar una pol\u00edtica de seguridad de contenido que no permita \"inseguro en l\u00ednea\" evitar\u00eda efectivamente que se aproveche esta vulnerabilidad.\u003c/a\u003e"
          }
        ],
        "id": "CVE-2024-32463",
        "lastModified": "2026-06-17T07:29:40.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-32463",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T18:58:58.573841Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-17T16:15:09.243",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T22:14:10+00:00",
      "cve": "CVE-2024-32463",
      "id": "CVE-2024-32463",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `\u003ca\u003e` tags",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-32463.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T02:13:39.303Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
              },
              {
                "name": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
              },
              {
                "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
              },
              {
                "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:ruby:fileutils:1.0.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "fileutils",
                "vendor": "ruby",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.0.0"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-32463",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-04-23T18:58:58.573841Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-04-23T19:01:11.273Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "phlex",
              "vendor": "phlex-ruby",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.10.0, \u003c 1.10.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.9.0, \u003c 1.9.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.8.0, \u003c 1.8.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.7.0, \u003c 1.7.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.6.0, \u003c 1.6.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.5.0, \u003c 1.5.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.4.0, \u003c 1.4.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `\u003ca\u003e` tag could be bypassed with tab `\\t` or newline `\\n` characters between the characters of the protocol, e.g. `java\\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-04-17T15:29:14.463Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"
            },
            {
              "name": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"
            },
            {
              "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"
            },
            {
              "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"
            }
          ],
          "source": {
            "advisory": "GHSA-g7xq-xv8c-h98c",
            "discovery": "UNKNOWN"
          },
          "title": "phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `\u003ca\u003e` tags"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-32463",
        "datePublished": "2024-04-17T15:29:14.463Z",
        "dateReserved": "2024-04-12T19:41:51.164Z",
        "dateUpdated": "2024-08-02T02:13:39.303Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.