[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwQj7EH8v5hlSEOTFLYwfXZ2MqxUBeH9Znp7Ndu8IgQ0":3,"g5a-risk:CVE-2022-23517":140},{"success":4,"data":5,"meta":137},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":35,"epssPercentile":26,"epssTimeSeries":36,"severity":38,"affectedProducts":39,"affectedProductsCount":50,"references":51,"referencesCount":82,"weaknesses":83,"weaknessesCount":92,"isActivelyExploited":93,"cisaInfo":26,"otxData":26,"relatedBlogPosts":94,"seoMetadata":95,"configurations":120,"relatedVendorCves":135,"notableEvents":136},"CVE-2022-23517","What is CVE-2022-23517?","rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer \u003C 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.","rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer \u003C 1.4.4 use an ineffi...","2022-12-14T17:15:10.13","2025-11-03T22:15:56.397",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":33,"CVSSMetricV2":34,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},[],[],0.01578,[37,37,37,35,35,35,35],0.01521,"High",[40,45],{"vendor":41,"product":42,"version":43,"criteria":44,"vulnerable":4},"rubyonrails","rails_html_sanitizers","*","cpe:2.3:a:rubyonrails:rails_html_sanitizers:*:*:*:*:*:rails:*:*",{"vendor":46,"product":47,"version":48,"criteria":49,"vulnerable":4},"debian","debian_linux","10.0","cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",2,[52,58,61,66,71,73,75,77,79],{"url":53,"source":54,"tags":55},"https:\u002F\u002Fgithub.com\u002Frails\u002Frails-html-sanitizer\u002Fcommit\u002F56c61c0cebd1e493e8ad7bca2a0191609a4a6979","GitHub",[56,57],"Patch","Third Party Advisory",{"url":59,"source":54,"tags":60},"https:\u002F\u002Fgithub.com\u002Frails\u002Frails-html-sanitizer\u002Fsecurity\u002Fadvisories\u002FGHSA-5x79-w82f-gw8w",[57],{"url":62,"source":63,"tags":64},"https:\u002F\u002Fhackerone.com\u002Freports\u002F1684163","Hackerone",[65,57],"Permissions Required",{"url":67,"source":68,"tags":69},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2023\u002F09\u002Fmsg00012.html","Debian",[70,57],"Mailing List",{"url":53,"source":54,"tags":72},[56,57],{"url":59,"source":54,"tags":74},[57],{"url":62,"source":63,"tags":76},[65,57],{"url":67,"source":68,"tags":78},[70,57],{"url":80,"source":68,"tags":81},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00045.html",[],9,[84],{"id":85,"name":86,"description":87,"extendedDescription":88,"status":89,"abstraction":90,"structure":91},"CWE-1333","Inefficient Regular Expression Complexity","The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.","Some regular expression engines have a feature called \"backtracking\". If the token cannot match, the engine \"backtracks\" to a position that may result in a different token that can match.\n                Backtracking becomes a weakness if all of these conditions are met:","Draft","Base","Simple",1,false,[],{"title":96,"metaDescription":97,"keywords":98,"canonicalUrl":99,"structuredData":100},"What is CVE-2022-23517? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-23517, a high severity cyber security vulnerability from 2022. rails-html-sanitizer is responsible for sanitizing HTML fra...","CVE-2022-23517, CVE-2022-23517 vulnerability, CVE-2022-23517 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, rubyonrails security, debian security, rails_html_sanitizers vulnerability, debian_linux vulnerability","\u002Fwhat-is\u002Fcve-2022-23517",{"@context":101,"@type":102,"headline":96,"description":97,"datePublished":10,"dateModified":11,"author":103,"publisher":107,"about":111,"mainEntityOfPage":115,"articleSection":118,"keywords":119},"https:\u002F\u002Fschema.org","TechArticle",{"@type":104,"name":105,"url":106},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":104,"name":105,"url":106,"logo":108},{"@type":109,"url":110},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":112,"name":6,"description":113,"additionalType":114},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":116,"@id":117},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-23517","Cybersecurity","CVE-2022-23517, CVE-2022-23517 vulnerability, CVE-2022-23517 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[121,129],{"Operator":26,"Negate":26,"Nodes":122},[123],{"Operator":124,"Negate":93,"CPEMatch":125},"OR",[126],{"Vulnerable":4,"Criteria":44,"MatchCriteriaID":127,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":128,"VersionEndIncluding":26},"CC2FBD9D-39C2-4D54-83B6-B3C334623A8D","1.4.4",{"Operator":26,"Negate":26,"Nodes":130},[131],{"Operator":124,"Negate":93,"CPEMatch":132},[133],{"Vulnerable":4,"Criteria":49,"MatchCriteriaID":134,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",[],[],{"lastModified":11,"cacheTime":138,"version":139},1792356211677,"2.0",{"score":141,"band":142,"action":143,"scoredAt":144},48,"Medium","Plan remediation","2026-10-16T06:56:30.701902+00:00"]