CVE-2024-32463 json
phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
published 2024-04-17 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1202 , GHSA-g7xq-xv8c-h98c
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.
Patch / fix
- rubygems phlex 1.4.2, 1.5.3, 1.6.3, 1.7.2, 1.8.3, 1.9.2, 1.10.1
- phlex phlex 1.4.2, 1.5.3, 1.6.3, 1.7.2, 1.8.3, 1.9.2, 1.10.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | phlex | >=1.10.0, <1.10.1 >=1.9.0, <1.9.2 >=1.8.0, <1.8.3 >=1.7.0, <1.7.2 >=1.6.0, <1.6.3 >=1.5.0, <1.5.3 <1.4.2 |
1.10.1 1.9.2 1.8.3 1.7.2 1.6.3 1.5.3 1.4.2 |
Affected products
- phlex-ruby phlex
- ruby fileutils
Classification
References
-
github.com
/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
web
-
github.com
/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
web
-
developer.mozilla.org
/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
web
-
developer.mozilla.org
/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-32463
advisory
-
github.com
/phlex-ruby/phlex
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32463.yml
web
Sources
- CVE List CVE-2024-32463
- GitHub Advisory GHSA-g7xq-xv8c-h98c
- NVD CVE-2024-32463
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.