CVE-2023-30614

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-306155.4Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site CVE-2023-306166.5Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery CVE-2023-306176.5Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1 CVE-2023-306183.3Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and veri CVE-2023-306195.4Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact CVE-2023-30629.8A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown fun CVE-2023-306207.5mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed u CVE-2023-306219.8Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run comman CVE-2023-306228.8Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to ve CVE-2023-306238.8`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` p CVE-2023-306248.8Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-insta CVE-2023-306258.8rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnera