Improper Neutralization of Script-Related HTML Tags in a Web Page in pay
CVE-2023-30614

7.1HIGH

Key Information:

Vendor

Pay-rails

Status
Pay
Vendor
CVE Published:
19 April 2023

What is CVE-2023-30614?

The Pay payments engine for Ruby on Rails versions prior to 6.3.2 contains a reflected Cross-site scripting vulnerability. This vulnerability allows attackers to craft malicious URLs that render a JavaScript payload when accessed by users of a Rails application integrating Pay. These URLs can be sent via email or shared through functions enabling user-generated content, targeting specific individuals. Updating to version 6.3.2 or higher mitigates this vulnerability, as no workarounds are available.

Affected Version(s)

pay < 6.3.2

References

https://github.com/pay-rails/pay/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/pay-rails/pay/commit/5d6283a24062bd272...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.