CVE-2024-32464mediumCWE-79CWE-80

CVE-2024-32464: falha de média gravidade em rails

ActionText ContentAttachment can Contain Unsanitized HTML

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rails+ Monitorar actiontext

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.4%
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
rails · rails
CVEs relacionadas — rails

No mesmo produto, das mais perigosas para as menos.

CVE-2026-66066CRITICALAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingEPSS 30.1%CVE-2022-23633HIGHExposure of sensitive information in Action PackEPSS 2.2%CVE-2024-26142HIGHRails possible ReDoS vulnerability in Accept header parsing in Action DispatchEPSS 1.5%CVE-2024-26144MEDIUMPossible Sensitive Session Information Leak in Active StorageEPSS 1.3%CVE-2010-3299—CVE-2010-3299EPSS 1.1%CVE-2024-41128MEDIUMAction Dispatch has possible ReDoS vulnerability in query parameter filteringEPSS 1.1%