CVE-2024-32464mediumCWE-79CWE-80

CVE-2024-32464: fallo de gravedad media en rails

ActionText ContentAttachment can Contain Unsanitized HTML

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear rails+ Monitorear actiontext

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.4%
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
rails · rails
CVEs relacionadas — rails

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-66066CRITICALAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingEPSS 30.1%CVE-2022-23633HIGHExposure of sensitive information in Action PackEPSS 2.2%CVE-2024-26142HIGHRails possible ReDoS vulnerability in Accept header parsing in Action DispatchEPSS 1.5%CVE-2024-26144MEDIUMPossible Sensitive Session Information Leak in Active StorageEPSS 1.3%CVE-2010-3299—CVE-2010-3299EPSS 1.1%CVE-2024-41128MEDIUMAction Dispatch has possible ReDoS vulnerability in query parameter filteringEPSS 1.1%