CVE-2022-22577

Published: 26 May 2022

An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

Notes

In Oneiric-Saucy, rails package is just for transition;
The rails package contains actual code from vivid onward

Priority

Medium

CVSS 3 base score: 6.1

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22577
• https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533
• NVD
• Launchpad
• Debian