Medium severity · published Jan 9, 2025
CVE-2023-23913
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute
6.3
CVSS
0.6%
EPSS
No
On KEV
Description
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
rails-ujs · Rails
6.1.7.3 before 6.1.7.3; 7.0.4.3 before 7.0.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23913
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23913
bugs.debian.org
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263
discuss.rubyonrails.org
https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468
github.com
https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd
security.netapp.com
https://security.netapp.com/advisory/ntap-20240605-0007/
www.debian.org
https://www.debian.org/security/2023/dsa-5389