The flaw is a cross-site scripting vulnerability in the Actionable Exceptions middleware of the actionpack gem, affecting versions 6.0.0 and later. It applies only when the application runs in development mode. An attacker who can get a victim to open a specially crafted URL, or to load one embedded in another page, can execute JavaScript in the context of the local application.
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Disclosed on 6 Jan 2021. No public exploit code or confirmed exploitation is recorded.
7 fixes in actionpack over 12 months. The latest fix listed for actionpack is 6.1.3.2.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: actionpack.
Upgrade to 6.0.3.5 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2021-22881).
gem "actionpack", ">= 6.0.3.5"First fixed in 6.0.3.4 for CVE-2020-8264.
| If you run | Upgrade to |
|---|---|
| 6.0.0 up to 6.0.3.4 | 6.0.3.5first fix for this CVE: 6.0.3.4 |
“Up to” means the second version is the fix and is not affected.