CVE-2016-6316: XSS
Published Sep 7, 2016
·Updated
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Affected Software
225 affected componentsFixes available
rubygems/actionview=5.0.0
5.0.0.1
rubygems/actionview>=4.0.0<=4.2.7
4.2.7.1
rubygems/actionview>=3.0.0<=3.2.22.2
3.2.22.3
rubyonrails Rails=3.0.0
rubyonrails Rails=3.0.0-beta
rubyonrails Rails=3.0.0-beta2
rubyonrails Rails=3.0.0-beta3
rubyonrails Rails=3.0.0-beta4
rubyonrails Rails=3.0.0-rc
rubyonrails Rails=3.0.0-rc2
rubyonrails Rails=3.0.1
rubyonrails Rails=3.0.2
rubyonrails Rails=3.0.3
rubyonrails Rails=3.0.4-rc1
rubyonrails Rails=3.0.5
rubyonrails Rails=3.0.5-rc1
rubyonrails Rails=3.0.6
rubyonrails Rails=3.0.6-rc1
rubyonrails Rails=3.0.6-rc2
rubyonrails Rails=3.0.7
rubyonrails Rails=3.0.7-rc1
rubyonrails Rails=3.0.7-rc2
rubyonrails Rails=3.0.8
rubyonrails Rails=3.0.8-rc1
rubyonrails Rails=3.0.8-rc2
rubyonrails Rails=3.0.8-rc3
rubyonrails Rails=3.0.8-rc4
rubyonrails Rails=3.0.9
rubyonrails Rails=3.0.9-rc1
rubyonrails Rails=3.0.9-rc2
rubyonrails Rails=3.0.9-rc3
rubyonrails Rails=3.0.9-rc4
rubyonrails Rails=3.0.9-rc5
rubyonrails Rails=3.0.10
rubyonrails Rails=3.0.10-rc1
rubyonrails Rails=3.0.11
rubyonrails Rails=3.0.12
rubyonrails Rails=3.0.12-rc1
rubyonrails Rails=3.0.13
rubyonrails Rails=3.0.13-rc1
rubyonrails Rails=3.0.14
rubyonrails Rails=3.0.16
rubyonrails Rails=3.0.17
rubyonrails Rails=3.0.18
rubyonrails Rails=3.0.19
rubyonrails Rails=3.0.20
rubyonrails Rails=3.1.0
rubyonrails Rails=3.1.0-beta1
rubyonrails Rails=3.1.0-rc1
rubyonrails Rails=3.1.0-rc2
rubyonrails Rails=3.1.0-rc3
rubyonrails Rails=3.1.0-rc4
rubyonrails Rails=3.1.0-rc5
rubyonrails Rails=3.1.0-rc6
rubyonrails Rails=3.1.0-rc7
rubyonrails Rails=3.1.0-rc8
rubyonrails Rails=3.1.1
rubyonrails Rails=3.1.1-rc1
rubyonrails Rails=3.1.1-rc2
rubyonrails Rails=3.1.1-rc3
rubyonrails Rails=3.1.2
rubyonrails Rails=3.1.2-rc1
rubyonrails Rails=3.1.2-rc2
rubyonrails Rails=3.1.3
rubyonrails Rails=3.1.4
rubyonrails Rails=3.1.4-rc1
rubyonrails Rails=3.1.5
rubyonrails Rails=3.1.5-rc1
rubyonrails Rails=3.1.6
rubyonrails Rails=3.1.7
rubyonrails Rails=3.1.8
rubyonrails Rails=3.1.9
rubyonrails Rails=3.1.10
rubyonrails Rails=3.1.12
rubyonrails Rails=3.2.0
rubyonrails Rails=3.2.0-rc1
rubyonrails Rails=3.2.0-rc2
rubyonrails Rails=3.2.1
rubyonrails Rails=3.2.2
rubyonrails Rails=3.2.2-rc1
rubyonrails Rails=3.2.3
rubyonrails Rails=3.2.3-rc1
rubyonrails Rails=3.2.3-rc2
rubyonrails Rails=3.2.4
rubyonrails Rails=3.2.4-rc1
rubyonrails Rails=3.2.5
rubyonrails Rails=3.2.6
rubyonrails Rails=3.2.7
rubyonrails Rails=3.2.7-rc1
rubyonrails Rails=3.2.8
rubyonrails Rails=3.2.8-rc1
rubyonrails Rails=3.2.8-rc2
rubyonrails Rails=3.2.9
rubyonrails Rails=3.2.9-rc1
rubyonrails Rails=3.2.9-rc2
rubyonrails Rails=3.2.9-rc3
rubyonrails Rails=3.2.10
rubyonrails Rails=3.2.11
rubyonrails Rails=3.2.12
rubyonrails Rails=3.2.13
rubyonrails Rails=3.2.13-rc1
rubyonrails Rails=3.2.13-rc2
rubyonrails Rails=3.2.15
rubyonrails Rails=3.2.15-rc3
rubyonrails Rails=3.2.16
rubyonrails Rails=3.2.17
rubyonrails Rails=3.2.18
rubyonrails Rails=3.2.21
rubyonrails Rails=3.2.22.2
rubyonrails Rails=4.0.0
rubyonrails Rails=4.0.0-beta
rubyonrails Rails=4.0.0-rc1
rubyonrails Rails=4.0.0-rc2
rubyonrails Rails=4.0.1
rubyonrails Rails=4.0.1-rc1
rubyonrails Rails=4.0.1-rc2
rubyonrails Rails=4.0.1-rc3
rubyonrails Rails=4.0.1-rc4
rubyonrails Rails=4.0.2
rubyonrails Rails=4.0.3
rubyonrails Rails=4.0.4
rubyonrails Rails=4.0.4-rc1
rubyonrails Rails=4.0.5
rubyonrails Rails=4.0.6
rubyonrails Rails=4.0.6-rc1
rubyonrails Rails=4.0.6-rc2
rubyonrails Rails=4.0.6-rc3
rubyonrails Rails=4.0.7
rubyonrails Rails=4.0.8
rubyonrails Rails=4.0.9
rubyonrails Rails=4.0.10
rubyonrails Rails=4.0.10-rc1
rubyonrails Rails=4.1.0
rubyonrails Rails=4.1.0-beta1
rubyonrails Rails=4.1.0-beta2
rubyonrails Rails=4.1.0-rc1
rubyonrails Rails=4.1.0-rc2
rubyonrails Rails=4.1.1
rubyonrails Rails=4.1.2
rubyonrails Rails=4.1.2-rc1
rubyonrails Rails=4.1.2-rc2
rubyonrails Rails=4.1.2-rc3
rubyonrails Rails=4.1.3
rubyonrails Rails=4.1.4
rubyonrails Rails=4.1.5
rubyonrails Rails=4.1.6
rubyonrails Rails=4.1.6-rc1
rubyonrails Rails=4.1.6-rc2
rubyonrails Rails=4.1.7
rubyonrails Rails=4.1.7.1
rubyonrails Rails=4.1.8
rubyonrails Rails=4.1.9
rubyonrails Rails=4.1.9-rc1
rubyonrails Rails=4.1.10
rubyonrails Rails=4.1.10-rc1
rubyonrails Rails=4.1.10-rc2
rubyonrails Rails=4.1.10-rc3
rubyonrails Rails=4.1.10-rc4
rubyonrails Rails=4.1.12
rubyonrails Rails=4.1.12-rc1
rubyonrails Rails=4.1.13
rubyonrails Rails=4.1.13-rc1
rubyonrails Rails=4.1.14
rubyonrails Rails=4.1.14-rc1
rubyonrails Rails=4.1.14-rc2
rubyonrails Rails=4.1.14.2
rubyonrails Rails=4.1.15
rubyonrails Rails=4.1.15-rc1
rubyonrails Rails=4.1.16
rubyonrails Rails=4.1.16-rc1
rubyonrails Rails=4.2.0
rubyonrails Rails=4.2.0-beta1
rubyonrails Rails=4.2.0-beta2
rubyonrails Rails=4.2.0-beta3
rubyonrails Rails=4.2.0-beta4
rubyonrails Rails=4.2.0-rc1
rubyonrails Rails=4.2.0-rc2
rubyonrails Rails=4.2.0-rc3
rubyonrails Rails=4.2.1
rubyonrails Rails=4.2.1-rc1
rubyonrails Rails=4.2.1-rc2
rubyonrails Rails=4.2.1-rc3
rubyonrails Rails=4.2.1-rc4
rubyonrails Rails=4.2.2
rubyonrails Rails=4.2.3
rubyonrails Rails=4.2.3-rc1
rubyonrails Rails=4.2.4
rubyonrails Rails=4.2.4-rc1
rubyonrails Rails=4.2.5
rubyonrails Rails=4.2.5-rc1
rubyonrails Rails=4.2.5-rc2
rubyonrails Rails=4.2.5.1
rubyonrails Rails=4.2.5.2
rubyonrails Rails=4.2.6
rubyonrails Rails=4.2.6-rc1
rubyonrails Rails=4.2.7
rubyonrails Rails=4.2.7-rc1
rubyonrails Rails=5.0.0-beta1
rubyonrails Rails=5.0.0-beta1.1
rubyonrails Rails=5.0.0-beta2
rubyonrails Rails=5.0.0-beta3
rubyonrails Rails=5.0.0-beta4
rubyonrails Rails=5.0.0-rc1
rubyonrails Rails=5.0.0-rc2
rubyonrails ruby on Rails=3.0.4
rubyonrails ruby on Rails=3.2.14
rubyonrails ruby on Rails=3.2.14-rc1
rubyonrails ruby on Rails=3.2.14-rc2
rubyonrails ruby on Rails=3.2.15-rc1
rubyonrails ruby on Rails=3.2.15-rc2
rubyonrails ruby on Rails=3.2.19
rubyonrails ruby on Rails=3.2.20
rubyonrails ruby on Rails=3.2.22
rubyonrails ruby on Rails=3.2.22.1
rubyonrails ruby on Rails=4.0.10-rc2
rubyonrails ruby on Rails=4.0.11
rubyonrails ruby on Rails=4.0.11.1
rubyonrails ruby on Rails=4.0.12
rubyonrails ruby on Rails=4.0.13
rubyonrails ruby on Rails=4.0.13-rc1
rubyonrails ruby on Rails=4.1.11
rubyonrails ruby on Rails=4.1.14.1
rubyonrails ruby on Rails=5.0.0
rubyonrails ruby on Rails=5.0.0-racecar1
Debian Debian Linux=8.0
Event History
Sep 7, 2016
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Oct 24, 2017
Advisory Published
06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2016-6316?
CVE-2016-6316 is classified as a medium severity vulnerability due to its ability to facilitate cross-site scripting (XSS).
2
How do I fix CVE-2016-6316?
To resolve CVE-2016-6316, update Action View in Ruby on Rails to version 3.2.22.3, 4.2.7.1, or 5.0.0.1 or later.
3
What does CVE-2016-6316 affect?
CVE-2016-6316 affects Ruby on Rails versions 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1.
4
What types of attacks can CVE-2016-6316 enable?
CVE-2016-6316 can allow remote attackers to inject arbitrary web scripts or HTML into web applications.
5
Is CVE-2016-6316 present in older versions of Ruby on Rails?
Yes, CVE-2016-6316 is present in multiple earlier versions of Ruby on Rails, primarily those before the specified remedial versions.