CVE-2024-32463
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
phlex
- Vendor
- phlex-ruby
- Product
- phlex
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| >= 1.10.0, < 1.10.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.9.0, < 1.9.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.8.0, < 1.8.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.7.0, < 1.7.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.6.0, < 1.6.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.5.0, < 1.5.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 1.4.0, < 1.4.2 | affected | Unavailable | Unavailable | Unavailable | None listed |