CVE-2024-39308

MEDIUM EPSS 43.3%
Published Jul 8, 20241y ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Jul 8, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released).

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
43.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 2

VendorProductVersionRange
rails_admin_projectrails_admin* <2.3.0
rails_admin_projectrails_admin*≥3.0.0  –  <3.1.3

References 6

  • github.com https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef
    Patch
  • github.com https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673
    Patch
  • github.com https://github.com/railsadminteam/rails_admin/issues/3686
    Issue Tracking
  • github.com https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc
    Vendor Advisory
  • rubygems.org https://rubygems.org/gems/rails_admin/versions/2.3.0
    Patch
  • rubygems.org https://rubygems.org/gems/rails_admin/versions/3.1.3
    Patch

Remediation

  • github.com https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef
    Patch
  • github.com https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673
    Patch
  • rubygems.org https://rubygems.org/gems/rails_admin/versions/2.3.0
    Patch
  • rubygems.org https://rubygems.org/gems/rails_admin/versions/3.1.3
    Patch