cvelistv5 - CVE-2022-24722

CVE-2022-24722 (GCVE-0-2022-24722)

Vulnerability from cvelistv5 – Published: 2022-03-02 22:40 – Updated: 2025-04-23 18:59

Summary

VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/github/view_component/security…	x_refsource_CONFIRM
	https://github.com/github/view_component/commit/3…	x_refsource_MISC
	https://github.com/github/view_component/releases…	x_refsource_MISC
	https://github.com/github/view_component/releases…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	github	view_component	Affected: >= 2.31.0, < 2.31.2 Affected: >= 2.32.0, < 2.49.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:49.891Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/github/view_component/releases/tag/v2.31.2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/github/view_component/releases/tag/v2.49.1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24722",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:55:32.558176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T18:59:13.837Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "view_component",
          "vendor": "github",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.31.0, \u003c 2.31.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.32.0, \u003c 2.49.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-02T22:40:11.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/github/view_component/releases/tag/v2.31.2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/github/view_component/releases/tag/v2.49.1"
        }
      ],
      "source": {
        "advisory": "GHSA-cm9w-c4rj-r2cf",
        "discovery": "UNKNOWN"
      },
      "title": "Cross-site Scripting in view_component",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24722",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting in view_component"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "view_component",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 2.31.0, \u003c 2.31.2"
                          },
                          {
                            "version_value": "\u003e= 2.32.0, \u003c 2.49.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "github"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf",
              "refsource": "CONFIRM",
              "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
            },
            {
              "name": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9",
              "refsource": "MISC",
              "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
            },
            {
              "name": "https://github.com/github/view_component/releases/tag/v2.31.2",
              "refsource": "MISC",
              "url": "https://github.com/github/view_component/releases/tag/v2.31.2"
            },
            {
              "name": "https://github.com/github/view_component/releases/tag/v2.49.1",
              "refsource": "MISC",
              "url": "https://github.com/github/view_component/releases/tag/v2.49.1"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-cm9w-c4rj-r2cf",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24722",
    "datePublished": "2022-03-02T22:40:11.000Z",
    "dateReserved": "2022-02-10T00:00:00.000Z",
    "dateUpdated": "2025-04-23T18:59:13.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:viewcomponent:*:*:*:*:*:ruby_on_rails:*:*\", \"versionStartIncluding\": \"2.31.0\", \"versionEndExcluding\": \"2.31.2\", \"matchCriteriaId\": \"8BFBC4AF-7D57-4CB1-9681-DFA439A5936A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:github:viewcomponent:*:*:*:*:*:ruby_on_rails:*:*\", \"versionStartIncluding\": \"2.32.0\", \"versionEndExcluding\": \"2.49.1\", \"matchCriteriaId\": \"DA1CA9C8-326A-4337-915E-BEB92EA1BAD0\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.\"}, {\"lang\": \"es\", \"value\": \"VIewComponent es un framework para construir componentes de visualizaci\\u00f3n en Ruby on Rails. Las versiones anteriores a 2.31.2 y 2.49.1 contienen una vulnerabilidad de tipo cross-site scripting que presenta el potencial de afectar a cualquiera usando traducciones con la gema view_component. Los datos recibidos por medio de la entrada del usuario y pasados como argumento de interpolaci\\u00f3n al m\\u00e9todo \\\"translate\\\" no son saneados apropiadamente antes de ser mostrados. Las versiones 2.31.2 y 2.49.1 han sido publicadas y mitigan completamente la vulnerabilidad. Como medida de mitigaci\\u00f3n, evite pasar entradas del usuario a la funci\\u00f3n \\\"translate\\\", o sanee las entradas antes de pasarlas\"}]",
      "id": "CVE-2022-24722",
      "lastModified": "2024-11-21T06:50:57.133",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2022-03-02T23:15:09.243",
      "references": "[{\"url\": \"https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.31.2\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.49.1\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.31.2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.49.1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-24722\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-03-02T23:15:09.243\",\"lastModified\":\"2024-11-21T06:50:57.133\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.\"},{\"lang\":\"es\",\"value\":\"VIewComponent es un framework para construir componentes de visualizaci\u00f3n en Ruby on Rails. Las versiones anteriores a 2.31.2 y 2.49.1 contienen una vulnerabilidad de tipo cross-site scripting que presenta el potencial de afectar a cualquiera usando traducciones con la gema view_component. Los datos recibidos por medio de la entrada del usuario y pasados como argumento de interpolaci\u00f3n al m\u00e9todo \\\"translate\\\" no son saneados apropiadamente antes de ser mostrados. Las versiones 2.31.2 y 2.49.1 han sido publicadas y mitigan completamente la vulnerabilidad. Como medida de mitigaci\u00f3n, evite pasar entradas del usuario a la funci\u00f3n \\\"translate\\\", o sanee las entradas antes de pasarlas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:viewcomponent:*:*:*:*:*:ruby_on_rails:*:*\",\"versionStartIncluding\":\"2.31.0\",\"versionEndExcluding\":\"2.31.2\",\"matchCriteriaId\":\"8BFBC4AF-7D57-4CB1-9681-DFA439A5936A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:viewcomponent:*:*:*:*:*:ruby_on_rails:*:*\",\"versionStartIncluding\":\"2.32.0\",\"versionEndExcluding\":\"2.49.1\",\"matchCriteriaId\":\"DA1CA9C8-326A-4337-915E-BEB92EA1BAD0\"}]}]}],\"references\":[{\"url\":\"https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/github/view_component/releases/tag/v2.31.2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/github/view_component/releases/tag/v2.49.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/github/view_component/releases/tag/v2.31.2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/github/view_component/releases/tag/v2.49.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.31.2\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.49.1\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T04:20:49.891Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-24722\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T15:55:32.558176Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T15:55:33.994Z\"}}], \"cna\": {\"title\": \"Cross-site Scripting in view_component\", \"source\": {\"advisory\": \"GHSA-cm9w-c4rj-r2cf\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"github\", \"product\": \"view_component\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.31.0, \u003c 2.31.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.32.0, \u003c 2.49.1\"}]}], \"references\": [{\"url\": \"https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.31.2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.49.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-03-02T22:40:11.000Z\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, \"source\": {\"advisory\": \"GHSA-cm9w-c4rj-r2cf\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"\u003e= 2.31.0, \u003c 2.31.2\"}, {\"version_value\": \"\u003e= 2.32.0, \u003c 2.49.1\"}]}, \"product_name\": \"view_component\"}]}, \"vendor_name\": \"github\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf\", \"name\": \"https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9\", \"name\": \"https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.31.2\", \"name\": \"https://github.com/github/view_component/releases/tag/v2.31.2\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/github/view_component/releases/tag/v2.49.1\", \"name\": \"https://github.com/github/view_component/releases/tag/v2.49.1\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-24722\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Cross-site Scripting in view_component\", \"ASSIGNER\": \"security-advisories@github.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-24722\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-23T18:59:13.837Z\", \"dateReserved\": \"2022-02-10T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-03-02T22:40:11.000Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-CM9W-C4RJ-R2CF

Vulnerability from github – Published: 2022-03-02 22:24 – Updated: 2022-03-11 20:08

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component

Details

Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the translate function, or sanitize the inputs before passing them.

For more information

If you have any questions or comments about this advisory: * Open an issue in the github/view_component project

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "view_component"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.31.0"
            },
            {
              "fixed": "2.31.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "view_component"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.32.0"
            },
            {
              "fixed": "2.49.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24722"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-02T22:24:05Z",
    "nvd_published_at": "2022-03-02T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display.\n\nVersions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.\n\nAvoid passing user input to the `translate` function, or sanitize the inputs before passing them.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [github/view_component](http://github.com/github/view_component) project\n",
  "id": "GHSA-cm9w-c4rj-r2cf",
  "modified": "2022-03-11T20:08:41Z",
  "published": "2022-03-02T22:24:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24722"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/view_component"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/view_component/releases/tag/v2.31.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/view_component/releases/tag/v2.49.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/view_component/CVE-2022-24722.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) in view_component"
}

FKIE_CVE-2022-24722

Vulnerability from fkie_nvd - Published: 2022-03-02 23:15 - Updated: 2024-11-21 06:50

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/github/view_component/releases/tag/v2.31.2	Third Party Advisory
security-advisories@github.com	https://github.com/github/view_component/releases/tag/v2.49.1	Third Party Advisory
security-advisories@github.com	https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/github/view_component/releases/tag/v2.31.2	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/github/view_component/releases/tag/v2.49.1	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf	Third Party Advisory

Impacted products

	Vendor	Product	Version
	github	viewcomponent	*
	github	viewcomponent	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:github:viewcomponent:*:*:*:*:*:ruby_on_rails:*:*",
              "matchCriteriaId": "8BFBC4AF-7D57-4CB1-9681-DFA439A5936A",
              "versionEndExcluding": "2.31.2",
              "versionStartIncluding": "2.31.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:github:viewcomponent:*:*:*:*:*:ruby_on_rails:*:*",
              "matchCriteriaId": "DA1CA9C8-326A-4337-915E-BEB92EA1BAD0",
              "versionEndExcluding": "2.49.1",
              "versionStartIncluding": "2.32.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them."
    },
    {
      "lang": "es",
      "value": "VIewComponent es un framework para construir componentes de visualizaci\u00f3n en Ruby on Rails. Las versiones anteriores a 2.31.2 y 2.49.1 contienen una vulnerabilidad de tipo cross-site scripting que presenta el potencial de afectar a cualquiera usando traducciones con la gema view_component. Los datos recibidos por medio de la entrada del usuario y pasados como argumento de interpolaci\u00f3n al m\u00e9todo \"translate\" no son saneados apropiadamente antes de ser mostrados. Las versiones 2.31.2 y 2.49.1 han sido publicadas y mitigan completamente la vulnerabilidad. Como medida de mitigaci\u00f3n, evite pasar entradas del usuario a la funci\u00f3n \"translate\", o sanee las entradas antes de pasarlas"
    }
  ],
  "id": "CVE-2022-24722",
  "lastModified": "2024-11-21T06:50:57.133",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-02T23:15:09.243",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/github/view_component/releases/tag/v2.31.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/github/view_component/releases/tag/v2.49.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/github/view_component/releases/tag/v2.31.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/github/view_component/releases/tag/v2.49.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CNVD-2022-19512

Vulnerability from cnvd - Published: 2022-03-15

Title

VIewComponent跨站脚本漏洞

Description

VIewComponent是一个在 Ruby on Rails 中构建可重用、可测试和封装的视图组件的框架。 VIewComponent存在跨站脚本漏洞，该漏洞源于通过用户输入接收并作为插值参数传递给translat方法的数据在显示之前未正确清理，目前没有详细漏洞细节提供。

Severity

中

Patch Name

VIewComponent跨站脚本漏洞的补丁

Patch Description

VIewComponent是一个在 Ruby on Rails 中构建可重用、可测试和封装的视图组件的框架。 VIewComponent存在跨站脚本漏洞，该漏洞源于通过用户输入接收并作为插值参数传递给translat方法的数据在显示之前未正确清理，目前没有详细漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf

Reference

https://nvd.nist.gov/vuln/detail/CVE-2022-24722

Impacted products

Name
['VIewComponent VIewComponent 2.31.2', 'VIewComponent VIewComponent <2.49.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-24722"
    }
  },
  "description": "VIewComponent\u662f\u4e00\u4e2a\u5728 Ruby on Rails \u4e2d\u6784\u5efa\u53ef\u91cd\u7528\u3001\u53ef\u6d4b\u8bd5\u548c\u5c01\u88c5\u7684\u89c6\u56fe\u7ec4\u4ef6\u7684\u6846\u67b6\u3002\n\nVIewComponent\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u901a\u8fc7\u7528\u6237\u8f93\u5165\u63a5\u6536\u5e76\u4f5c\u4e3a\u63d2\u503c\u53c2\u6570\u4f20\u9012\u7ed9translat\u65b9\u6cd5\u7684\u6570\u636e\u5728\u663e\u793a\u4e4b\u524d\u672a\u6b63\u786e\u6e05\u7406\uff0c\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-19512",
  "openTime": "2022-03-15",
  "patchDescription": "VIewComponent\u662f\u4e00\u4e2a\u5728 Ruby on Rails \u4e2d\u6784\u5efa\u53ef\u91cd\u7528\u3001\u53ef\u6d4b\u8bd5\u548c\u5c01\u88c5\u7684\u89c6\u56fe\u7ec4\u4ef6\u7684\u6846\u67b6\u3002\r\n\r\nVIewComponent\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u901a\u8fc7\u7528\u6237\u8f93\u5165\u63a5\u6536\u5e76\u4f5c\u4e3a\u63d2\u503c\u53c2\u6570\u4f20\u9012\u7ed9translat\u65b9\u6cd5\u7684\u6570\u636e\u5728\u663e\u793a\u4e4b\u524d\u672a\u6b63\u786e\u6e05\u7406\uff0c\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "VIewComponent\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "VIewComponent VIewComponent 2.31.2",
      "VIewComponent VIewComponent \u003c2.49.1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-24722",
  "serverity": "\u4e2d",
  "submitTime": "2022-03-04",
  "title": "VIewComponent\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

GSD-2022-24722

Vulnerability from gsd - Updated: 2022-03-02 00:00

Details

This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. Avoid passing user input to the `translate` function, or sanitize the inputs before passing them.

Aliases

CVE-2022-24722

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-24722",
    "description": "VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.",
    "id": "GSD-2022-24722"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "view_component",
            "purl": "pkg:gem/view_component"
          }
        }
      ],
      "aliases": [
        "CVE-2022-24722",
        "GHSA-cm9w-c4rj-r2cf"
      ],
      "details": "This is an XSS vulnerability that has the potential to impact anyone using\ntranslations with the view_component gem. Data received via user input and\npassed as an interpolation argument to the `translate` method is not properly\nsanitized before display.\n\nVersions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability.\n\nAvoid passing user input to the `translate` function, or sanitize the inputs\nbefore passing them.\n",
      "id": "GSD-2022-24722",
      "modified": "2022-03-02T00:00:00.000Z",
      "published": "2022-03-02T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
        },
        {
          "type": "WEB",
          "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 8.1,
          "type": "CVSS_V3"
        }
      ],
      "summary": "XSS via `translate` method of `ViewComponent::Translatable` in view_component gem"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-24722",
        "STATE": "PUBLIC",
        "TITLE": "Cross-site Scripting in view_component"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "view_component",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 2.31.0, \u003c 2.31.2"
                        },
                        {
                          "version_value": "\u003e= 2.32.0, \u003c 2.49.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "github"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf",
            "refsource": "CONFIRM",
            "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
          },
          {
            "name": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9",
            "refsource": "MISC",
            "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
          },
          {
            "name": "https://github.com/github/view_component/releases/tag/v2.31.2",
            "refsource": "MISC",
            "url": "https://github.com/github/view_component/releases/tag/v2.31.2"
          },
          {
            "name": "https://github.com/github/view_component/releases/tag/v2.49.1",
            "refsource": "MISC",
            "url": "https://github.com/github/view_component/releases/tag/v2.49.1"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-cm9w-c4rj-r2cf",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2022-24722",
      "cvss_v3": 8.1,
      "date": "2022-03-02",
      "description": "This is an XSS vulnerability that has the potential to impact anyone using\ntranslations with the view_component gem. Data received via user input and\npassed as an interpolation argument to the `translate` method is not properly\nsanitized before display.\n\nVersions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability.\n\nAvoid passing user input to the `translate` function, or sanitize the inputs\nbefore passing them.\n",
      "gem": "view_component",
      "ghsa": "cm9w-c4rj-r2cf",
      "patched_versions": [
        "\u003e= 2.49.1",
        "~\u003e 2.31.2"
      ],
      "related": {
        "url": [
          "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
        ]
      },
      "title": "XSS via `translate` method of `ViewComponent::Translatable` in view_component gem",
      "unaffected_versions": [
        "\u003c 2.31.0"
      ],
      "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=2.31.0 \u003c2.31.2||\u003e=2.32.0 \u003c2.49.1",
          "affected_versions": "All versions starting from 2.31.0 before 2.31.2, all versions starting from 2.32.0 before 2.49.1",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2022-03-02",
          "description": "VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.",
          "fixed_versions": [
            "2.31.2",
            "2.49.1"
          ],
          "identifier": "CVE-2022-24722",
          "identifiers": [
            "GHSA-cm9w-c4rj-r2cf",
            "CVE-2022-24722"
          ],
          "not_impacted": "All versions before 2.31.0, all versions starting from 2.31.2 before 2.32.0, all versions starting from 2.49.1",
          "package_slug": "gem/view_component",
          "pubdate": "2022-03-02",
          "solution": "Upgrade to versions 2.31.2, 2.49.1 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf",
            "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9",
            "https://github.com/advisories/GHSA-cm9w-c4rj-r2cf"
          ],
          "uuid": "30f88fbc-2727-4fb2-b179-507a18633961"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:github:viewcomponent:*:*:*:*:*:ruby_on_rails:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.31.2",
                "versionStartIncluding": "2.31.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:github:viewcomponent:*:*:*:*:*:ruby_on_rails:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.49.1",
                "versionStartIncluding": "2.32.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24722"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/github/view_component/releases/tag/v2.31.2",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/github/view_component/releases/tag/v2.31.2"
            },
            {
              "name": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf"
            },
            {
              "name": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9"
            },
            {
              "name": "https://github.com/github/view_component/releases/tag/v2.49.1",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/github/view_component/releases/tag/v2.49.1"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2022-03-10T15:32Z",
      "publishedDate": "2022-03-02T23:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-24722 (GCVE-0-2022-24722)

GHSA-CM9W-C4RJ-R2CF

For more information

FKIE_CVE-2022-24722

CNVD-2022-19512

GSD-2022-24722

Tags

Sightings

Nomenclature