CVE-2024-32463: Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
(updated )
There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.
Our filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an <a> tag could be bypassed with tab \t or newline \n characters between the characters of the protocol, e.g. java\tscript:.
References
- developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
- developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
- github.com/advisories/GHSA-g7xq-xv8c-h98c
- github.com/phlex-ruby/phlex
- github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
- github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
- github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32463.yml
- nvd.nist.gov/vuln/detail/CVE-2024-32463
Code Behaviors & Features
Detect and mitigate CVE-2024-32463 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →