Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-24722— Cross-site Scripting in view_component

Quick assessment

Affected
github view_component
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VIewComponent是一个在 Ruby on Rails 中构建可重用、可测试和封装的视图组件的框架。 VIewComponent 存在跨站脚本漏洞，该漏洞通过用户输入接收并作为插值参数传递给translat方法的数据在显示之前未正确清理。

CVSS 8.1 · High EPSS 1.09% · P64

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-24722

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-site Scripting in view_component
Source: CVE Program / CVE List V5
Vulnerability Description
VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
VIewComponent 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VIewComponent是一个在 Ruby on Rails 中构建可重用、可测试和封装的视图组件的框架。 VIewComponent 存在跨站脚本漏洞，该漏洞通过用户输入接收并作为插值参数传递给translat方法的数据在显示之前未正确清理。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
github view_component >= 2.31.0, < 2.31.2 -

II. Public POCs for CVE-2022-24722

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-24722

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-24722 (1)

Vendor Advisories for CVE-2022-24722 (1)

Other References for CVE-2022-24722 (2)

IV. Related Vulnerabilities

Same product: view_component
Same vendor: github
Same weakness: CWE-79

V. Comments for CVE-2022-24722

No comments yet

Leave a comment