logo

Database

Server side template injection In rails

Description

A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-218312. NVD-2022-218313. OSV-DEBIAN-2022-218314. OSV-2022-218315. GHSA-w749-p3v6-hccq6. GCVE-2022-218317. SECURITY-TRACKER-CVE-2022-218318. lists.debian.org

References

1. https://github.com/usutani/study-turbolinks-link2. https://github.com/rails/rails/commit/0a72f7d670e9aa77a0bb8584cb1411ddabb7546e3. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2022-21831.yml4. https://groups.google.com/g/rubyonrails-security/c/n-p-W1yxatI5. https://rubysec.com/advisories/CVE-2022-218316. https://security.netapp.com/advisory/ntap-20221118-00017. https://www.debian.org/security/2023/dsa-5372

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.