Description
RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
railsadminteam rails_admin
>= 3.0.0, < 3.1.3affected< 2.3.0affected
References
- https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc ↗
- https://github.com/railsadminteam/rails_admin/issues/3686 ↗
- https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef ↗
- https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673 ↗
- https://rubygems.org/gems/rails_admin/versions/2.3.0 ↗
- https://rubygems.org/gems/rails_admin/versions/3.1.3 ↗