{"id":"CVE-2022-27777","published":"2022-05-26T00:00:00Z","modified":"2024-08-03T05:32:59Z","title":"A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if…","vendor":null,"product":null,"tier":"tail","description":{"text":"A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01665,"percentile":0.76639,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html","tags":["mailing-list"]},{"url":"https://www.debian.org/security/2023/dsa-5372","tags":["vendor-advisory"]}],"priority":{"score":15.3,"factors":[{"name":"EPSS percentile","points":15.33}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1"]}],"affected":[{"ecosystem":"RubyGems","package":"actionview","vulnerableRanges":["<5.2.7.1",">=6.0.0, <6.0.4.8",">=6.1.0, <6.1.5.1",">=7.0.0, <7.0.2.4"],"patched":["5.2.7.1","6.0.4.8","6.1.5.1","7.0.2.4"],"from":["GHSA-ch3h-j2vf-95pv"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1707","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-5267","published":"2020-03-19","fixed":"6.0.2.2","kev":false},{"cve":"CVE-2020-8167","published":"2020-06-19","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-15169","published":"2020-09-11","fixed":"6.0.3.3","kev":false,"link":{"from":"CVE-2020-15169","to":"CVE-2022-27777","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"5.2.4.4","toFixed":"5.2.7.1","daysApart":622},{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"6.0.3.3","toFixed":"6.0.4.8","daysApart":622}]}},{"cve":"CVE-2022-27777","published":"2022-05-26","fixed":"7.0.2.4","kev":false},{"cve":"CVE-2023-23913","published":"2025-01-09","fixed":"7.0.4.3","kev":false},{"cve":"CVE-2026-33168","published":"2026-03-23","fixed":"8.1.2.1","kev":false}],"package":"RubyGems:actionview"}}