GHSA SYNC: Added brand new advisory (#793)

Author: jasnow

gems/rails_admin/CVE-2024-39308.yml

@@ -0,0 +1,47 @@
+---
+gem: rails_admin
+cve: 2024-39308
+ghsa: 8qgm-g2vv-vwvc
+url: https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc
+title: RailsAdmin Cross-site Scripting vulnerability in the list view
+date: 2024-07-08
+description: |
+  ### Impact
+  RailsAdmin list view has the XSS vulnerability, caused by
+  improperly-escaped HTML title attribute. The issue was originally
+  reported in https://github.com/railsadminteam/rails_admin/issues/3686.
+
+  ### Patches
+  Upgrade to [3.1.3](https://rubygems.org/gems/rails_admin/versions/3.1.3)
+  or [2.3.0](https://rubygems.org/gems/rails_admin/versions/2.3.0).
+
+  ### Workarounds
+  1. Copy the index view (located under the path
+     `app/views/rails_admin/main/index.html.erb`) from the RailsAdmin
+     version you use, and place it into your application by using
+     the same path.
+
+  2. Open the view file by an editor, and remove `strip_tags` from
+     the title attribute (as shown in GHSA advisory below).
+
+  **Note:** The view file created by this needs to be removed after
+  upgrading RailsAdmin afterwards, unless this old view continue to
+  be used. Only do this if you can't upgrade RailsAdmin now for a reason.
+
+  ### References
+  https://owasp.org/www-community/attacks/xss/
+  https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-strip_tags
+cvss_v3: 6.8
+patched_versions:
+  - "~> 2.3.0"
+  - ">= 3.1.3"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-39308
+    - https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc
+    - https://github.com/railsadminteam/rails_admin/issues/3686
+    - https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef
+    - https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673
+    - https://rubygems.org/gems/rails_admin/versions/2.3.0
+    - https://rubygems.org/gems/rails_admin/versions/3.1.3
+    - https://github.com/advisories/GHSA-8qgm-g2vv-vwvc