coffee-rails-4.2.2.gem: 1 vulnerabilities (highest severity is: 5.4) - autoclosed

[mend-for-github-com[bot]]

Vulnerable Library - coffee-rails-4.2.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-5.2.8.1.gem

Found in HEAD commit: 7d45750902e2450bdb22ac9f0b6cd476803f070a

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (coffee-rails version)	Remediation Available
CVE-2022-3704	Medium	5.4	actionpack-5.2.8.1.gem	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-3704

### Vulnerable Library - actionpack-5.2.8.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-5.2.8.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-5.2.8.1.gem

Dependency Hierarchy: - coffee-rails-4.2.2.gem (Root Library) - railties-5.2.8.1.gem - :x: **actionpack-5.2.8.1.gem** (Vulnerable Library)

Found in HEAD commit: 7d45750902e2450bdb22ac9f0b6cd476803f070a

Found in base branch: main

### Vulnerability Details

A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212319.

Publish Date: 2022-10-26

URL: CVE-2022-3704

### CVSS 3 Score Details (5.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.