CVE-2024-32463
CVSS 3.1 Score 7.1 of 10 (high)
Details
Summary
CVE-2024-32463 is a newly identified cross-site scripting (XSS) vulnerability affecting the open-source phlex framework used for building object-oriented views in Ruby. Maliciously crafted user data can exploit this issue by bypassing the filter designed to prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag. The bypass technique involves using tab (`\t`) or newline (`\n`) characters between the characters of the protocol. Phlex users are advised to update to versions 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, or 1.4.2 to mitigate this risk. Alternatively, implementing a Content Security Policy that disallows `unsafe-inline` can effectively prevent this vulnerability from being exploited.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions