{ "document" : { "aggregate_severity" : { "text" : "niedrig" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.", "title" : "Angriff" }, { "category" : "general", "text" : "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2023-1577 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1577.json" }, { "category" : "self", "summary" : "WID-SEC-2023-1577 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1577" }, { "category" : "external", "summary" : "Ruby Security Announcements vom 2023-06-27", "url" : "https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2023:3229-1 vom 2023-08-08", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2023-August/015808.html" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2023:3255-1 vom 2023-08-09", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2023-August/015832.html" }, { "category" : "external", "summary" : "IBM Security Bulletin 7037764 vom 2023-09-22", "url" : "https://www.ibm.com/support/pages/node/7037764" }, { "category" : "external", "summary" : "IBM Security Bulletin 1126755 vom 2023-10-16", "url" : "https://www.ibm.com/support/pages/node/1126755" }, { "category" : "external", "summary" : "Red Hat Security Advisory RHSA-2023:7851 vom 2023-12-15", "url" : "https://access.redhat.com/errata/RHSA-2023:7851" }, { "category" : "external", "summary" : "Debian Security Advisory DSA-5881 vom 2025-03-17", "url" : "https://lists.debian.org/debian-security-announce/2025/msg00043.html" }, { "category" : "external", "summary" : "Debian Security Advisory DLA-4383 vom 2025-11-25", "url" : "https://lists.debian.org/debian-lts-announce/2025/11/msg00026.html" } ], "source_lang" : "en-US", "title" : "Ruby on Rails: Schwachstelle ermöglicht Cross-Site Scripting", "tracking" : { "current_release_date" : "2025-11-25T23:00:00.000+00:00", "generator" : { "date" : "2025-11-26T11:15:42.427+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.5.0" } }, "id" : "WID-SEC-W-2023-1577", "initial_release_date" : "2023-06-27T22:00:00.000+00:00", "revision_history" : [ { "date" : "2023-06-27T22:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" }, { "date" : "2023-08-08T22:00:00.000+00:00", "number" : "2", "summary" : "Neue Updates von SUSE aufgenommen" }, { "date" : "2023-08-09T22:00:00.000+00:00", "number" : "3", "summary" : "Neue Updates von SUSE aufgenommen" }, { "date" : "2023-09-21T22:00:00.000+00:00", "number" : "4", "summary" : "Neue Updates von IBM aufgenommen" }, { "date" : "2023-10-16T22:00:00.000+00:00", "number" : "5", "summary" : "Neue Updates von IBM aufgenommen" }, { "date" : "2023-12-14T23:00:00.000+00:00", "number" : "6", "summary" : "Neue Updates von Red Hat aufgenommen" }, { "date" : "2025-03-17T23:00:00.000+00:00", "number" : "7", "summary" : "Neue Updates von Debian aufgenommen" }, { "date" : "2025-11-25T23:00:00.000+00:00", "number" : "8", "summary" : "Neue Updates von Debian aufgenommen" } ], "status" : "final", "version" : "8" } }, "product_tree" : { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Debian Linux", "product" : { "name" : "Debian Linux", "product_id" : "2951", "product_identification_helper" : { "cpe" : "cpe:/o:debian:debian_linux:-" } } } ], "category" : "vendor", "name" : "Debian" }, { "branches" : [ { "branches" : [ { "category" : "product_version", "name" : "9.2", "product" : { "name" : "IBM License Metric Tool 9.2", "product_id" : "T027649", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:license_metric_tool:9.2" } } }, { "category" : "product_version_range", "name" : "<9.2.33", "product" : { "name" : "IBM License Metric Tool <9.2.33", "product_id" : "T030111" } }, { "category" : "product_version", "name" : "9.2.33", "product" : { "name" : "IBM License Metric Tool 9.2.33", "product_id" : "T030111-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:ibm:license_metric_tool:9.2.33" } } } ], "category" : "product_name", "name" : "License Metric Tool" } ], "category" : "vendor", "name" : "IBM" }, { "branches" : [ { "branches" : [ { "category" : "product_version_range", "name" : "<7.0.5.1", "product" : { "name" : "Open Source Ruby on Rails <7.0.5.1", "product_id" : "T028335" } }, { "category" : "product_version", "name" : "7.0.5.1", "product" : { "name" : "Open Source Ruby on Rails 7.0.5.1", "product_id" : "T028335-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:7.0.5.1" } } }, { "category" : "product_version_range", "name" : "<6.1.7.4", "product" : { "name" : "Open Source Ruby on Rails <6.1.7.4", "product_id" : "T028336" } }, { "category" : "product_version", "name" : "6.1.7.4", "product" : { "name" : "Open Source Ruby on Rails 6.1.7.4", "product_id" : "T028336-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:6.1.7.4" } } } ], "category" : "product_name", "name" : "Ruby on Rails" } ], "category" : "vendor", "name" : "Open Source" }, { "branches" : [ { "category" : "product_name", "name" : "Red Hat Enterprise Linux", "product" : { "name" : "Red Hat Enterprise Linux", "product_id" : "67646", "product_identification_helper" : { "cpe" : "cpe:/o:redhat:enterprise_linux:-" } } } ], "category" : "vendor", "name" : "Red Hat" }, { "branches" : [ { "category" : "product_name", "name" : "SUSE Linux", "product" : { "name" : "SUSE Linux", "product_id" : "T002207", "product_identification_helper" : { "cpe" : "cpe:/o:suse:suse_linux:-" } } } ], "category" : "vendor", "name" : "SUSE" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2023-28362", "product_status" : { "known_affected" : [ "T030111", "2951", "T002207", "T027649", "67646", "T028336", "T028335" ] }, "release_date" : "2023-06-27T22:00:00.000+00:00", "title" : "CVE-2023-28362" } ] }