onyx --cves cve-2022-23633
CVE-2022-23633
- score
- <0.1
- cvss
- 7.4
- epss
- 2.2%
- published
- 2022-02-11
- kev added
- —
- first seen
Action Pack in Rails versions before 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1 contains a response body handling issue caused by not closing response bodies, letting data leaks occur between requests, exploit requires specific request handling.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 6
- https://www.debian.org/security/2023/dsa-5372
- https://security.netapp.com/advisory/ntap-20240119-0013/
- http://www.openwall.com/lists/oss-security/2022/02/11/5
- https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da
- https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html