{"id":"CVE-2024-32463","published":"2024-04-17T15:29:14Z","modified":"2024-08-02T02:13:39Z","title":"phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags","vendor":"phlex-ruby","product":"phlex","tier":"tail","description":{"text":"phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\\t` or newline `\\n` characters between the characters of the protocol, e.g. `java\\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00575,"percentile":0.47455,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb","tags":["x_refsource_MISC"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy","tags":["x_refsource_MISC"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline","tags":["x_refsource_MISC"]}],"priority":{"score":14.5,"factors":[{"name":"EPSS percentile","points":9.49},{"name":"CVSS severity","points":4.97}]},"vendorSlug":"phlex-ruby","affectedVersions":[{"vendor":"phlex-ruby","product":"phlex","versions":[">= 1.10.0, < 1.10.1",">= 1.9.0, < 1.9.2",">= 1.8.0, < 1.8.3",">= 1.7.0, < 1.7.2",">= 1.6.0, < 1.6.3",">= 1.5.0, < 1.5.3",">= 1.4.0, < 1.4.2"]}],"affected":[{"ecosystem":"RubyGems","package":"phlex","vulnerableRanges":[">=1.10.0, <1.10.1",">=1.9.0, <1.9.2",">=1.8.0, <1.8.3",">=1.7.0, <1.7.2",">=1.6.0, <1.6.3",">=1.5.0, <1.5.3","<1.4.2"],"patched":["1.10.1","1.9.2","1.8.3","1.7.2","1.6.3","1.5.3","1.4.2"],"from":["GHSA-g7xq-xv8c-h98c"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1202","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-phlex-ruby-phlex-cve-2024-28199","parents":[{"from":"CVE-2024-28199","to":"CVE-2024-32463","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:phlex","fromFixed":"1.9.1","toFixed":"1.9.2","daysApart":37},{"kind":"same-code","provenance":"machine","files":["lib/phlex/sgml.rb"],"commits":["https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1","https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.47,"basis":"same product + CWE + description similarity"}]}],"children":[{"from":"CVE-2024-32463","to":"CVE-2024-32970","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:phlex","fromFixed":"1.9.2","toFixed":"1.9.3","daysApart":13},{"kind":"same-code","provenance":"machine","files":["lib/phlex/sgml.rb"],"commits":["https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb","https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2"],"basis":"shared function","functions":["__attributes__"]},{"kind":"similar","provenance":"machine","score":0.36,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2024-28199","published":"2024-03-11","fixed":"1.9.1","kev":false},{"cve":"CVE-2024-32463","published":"2024-04-17","fixed":"1.10.1","kev":false},{"cve":"CVE-2024-32970","published":"2024-04-30","fixed":"1.10.2","kev":false}],"package":"RubyGems:phlex"}}