{"schemaVersion":3,"id":"CVE-2023-23913","aliases":["SUSE-SU-2023:3813-1","UBUNTU-CVE-2023-23913","DEBIAN-CVE-2023-23913","GHSA-xp5h-f8jf-rc8q"],"status":"published","duplicateOf":null,"title":null,"description":"There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.","dates":{"published":"2025-01-09T00:33:47.769Z","modified":"2025-01-09T17:09:39.091Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":7.2,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":7.2,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Rubygems","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":7.2,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00639,"percentile":0.49688,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.02599999999999998,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00613},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00639,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00639,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00639,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00639,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00639,"percentile":0.49688}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00613,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00639,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00639,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00639,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00639,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00639,"percentile":0.49688}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"debian","product":"rails","name":"rails","label":"rails","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/rails","purlType":"deb","versions":[{"text":"< 2:6.1.7.3+dfsg-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2:6.1.7.3+dfsg-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"rails","name":"rails","label":"rails","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/rails","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"RubyGems","product":"actionview","name":"actionview","label":"actionview","ecosystem":"RubyGems","cpePart":null,"purl":"pkg:gem/actionview","purlType":"gem","versions":[{"text":"≥ 5.1.0, < 6.1.7.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.4.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.1.0, < 6.1.7.3 | ≥ 7.0.0, < 7.0.4.3","eol":null,"hubHref":null},{"vendor":"rails","product":"rails-ujs","name":"rails-ujs","label":"rails-ujs","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.1.7.3, < 6.1.7.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.4.3, < 7.0.4.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.1.7.3, < 6.1.7.3 | ≥ 7.0.4.3, < 7.0.4.3","eol":null,"hubHref":"/vendor/rails/rails-ujs"},{"vendor":"opensuse","product":"rubygem-actionview-5_1&distro=openSUSE Leap 15.4","name":"rubygem-actionview-5_1","label":"rubygem-actionview-5_1&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/rubygem-actionview-5_1&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 5.1.4-150000.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.4-150000.3.9.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"rubygem-actionview-5_1&distro=openSUSE Leap 15.5","name":"rubygem-actionview-5_1","label":"rubygem-actionview-5_1&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/rubygem-actionview-5_1&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 5.1.4-150000.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.4-150000.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP1","name":"rubygem-actionview-5_1","label":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP1","purlType":"rpm","versions":[{"text":"< 5.1.4-150000.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.4-150000.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP2","name":"rubygem-actionview-5_1","label":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP2","purlType":"rpm","versions":[{"text":"< 5.1.4-150000.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.4-150000.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP3","name":"rubygem-actionview-5_1","label":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP3","purlType":"rpm","versions":[{"text":"< 5.1.4-150000.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.4-150000.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP4","name":"rubygem-actionview-5_1","label":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP4","purlType":"rpm","versions":[{"text":"< 5.1.4-150000.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.4-150000.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP5","name":"rubygem-actionview-5_1","label":"rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP5","purlType":"rpm","versions":[{"text":"< 5.1.4-150000.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.4-150000.3.9.1","eol":null,"hubHref":null}],"affectedCount":11,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263","label":"bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263","hostname":"bugs.debian.org","tags":["WEB"]},{"url":"https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468","label":"discuss.rubyonrails.org/t/…","hostname":"discuss.rubyonrails.org","tags":["REPORT","WEB"]},{"url":"https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd","label":"github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd","hostname":"github.com","tags":["REPORT","WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20240605-0007/","label":"security.netapp.com/advisory/ntap-20240605-0007/","hostname":"security.netapp.com","tags":[]},{"url":"https://www.debian.org/security/2023/dsa-5389","label":"www.debian.org/security/2023/dsa-5389","hostname":"www.debian.org","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233813-1/","label":"www.suse.com/support/update/announcement/2023/suse-su-20233813-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1209826","label":"bugzilla.suse.com/1209826","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23913","label":"www.suse.com/security/cve/CVE-2023-23913","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2023-23913","label":"ubuntu.com/security/CVE-2023-23913","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23913","label":"www.cve.org/CVERecord?id=CVE-2023-23913","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-23913","label":"security-tracker.debian.org/tracker/CVE-2023-23913","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23913","label":"nvd.nist.gov/vuln/detail/CVE-2023-23913","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/rails/rails/commit/73009ea59a811b28e8ec2a9c9bc24635aa891214","label":"github.com/rails/rails/commit/73009ea59a811b28e8ec2a9c9bc24635aa891214","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/rails/rails","label":"github.com/rails/rails","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2023-23913.yml","label":"github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2023-23913.yml","hostname":"github.com","tags":["WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20240605-0007","label":"security.netapp.com/advisory/ntap-20240605-0007","hostname":"security.netapp.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["DSA-5389-1"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-01-09T00:33:47.769Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-01-09T17:09:39.091Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:14:50.773Z","stale":false,"partial":false}}