See on RubyGems

rails_admin 0.2.0

3 security vulnerabilities found in version 0.2.0

RailsAdmin Cross-site Scripting vulnerability in the list view

high severity CVE-2024-39308
high severity CVE-2024-39308
Patched versions: ~> 2.3.0, >= 3.1.3

Impact

RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. The issue was originally reported in https://github.com/railsadminteam/rails_admin/issues/3686.

Patches

Upgrade to 3.1.3 or 2.3.0.

Workarounds

  1. Copy the index view (located under the path app/views/rails_admin/main/index.html.erb) from the RailsAdmin version you use, and place it into your application by using the same path.

  2. Open the view file by an editor, and remove strip_tags from the title attribute (as shown in GHSA advisory below).

Note: The view file created by this needs to be removed after upgrading RailsAdmin afterwards, unless this old view continue to be used. Only do this if you can't upgrade RailsAdmin now for a reason.

References

https://owasp.org/www-community/attacks/xss/ https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags

rails_admin ruby gem XSS vulnerability

medium severity CVE-2020-36190
medium severity CVE-2020-36190
Patched versions: ~> 1.4.3, >= 2.0.2

RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.

rails_admin ruby gem XSS vulnerability

medium severity CVE-2017-12098
medium severity CVE-2017-12098
Patched versions: >= 1.3.0

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.

No officially reported memory leakage issues detected.

This gem version does not have any officially reported memory leaked issues.

Gem version without a license.

Unless a license that specifies otherwise is included, nobody can use, copy, distribute, or modify this library without being at risk of take-downs, shake-downs, or litigation.

This gem version is available.

This gem version has not been yanked and is still available for usage.