CVE-2023-28120 (Medium) detected in rails-5.2.3.gem

[mend-bolt-for-github[bot]]

CVE-2023-28120 - Medium Severity Vulnerability

Vulnerable Library - rails-5.2.3.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-5.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /em/ruby/2.7.0/cache/rails-5.2.3.gem

Dependency Hierarchy: - :x: **rails-5.2.3.gem** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A Possible XSS Security Vulnerability was discovered in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. All versions before 6.1.7.3 and 7.x before 7.0.4.3 are affected.

Publish Date: 2023-03-11

URL: CVE-2023-28120

CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469

Release Date: 2023-03-11

Fix Resolution: rails - 6.1.7.3,7.0.4.3

---

Step up your Open Source Security Game with Mend here

[chatcody[bot]]

Based on the information provided, it appears that the rails-5.2.3.gem library is vulnerable to a possible XSS security vulnerability. The suggested fix is to upgrade to version 6.1.7.3 or 7.0.4.3 of the rails library.

To implement the fix, the following steps can be taken:

1. Update the Gemfile with the new version of the rails library:

   gem 'rails', '~> 6.1.7.3'

2. Run bundle update rails to update the rails library.
3. Verify that the new version of the rails library is installed:

   bundle show rails

If there are any issues or questions regarding the implementation of the fix, please provide more details on the issue.