CVE-2020-5267
Possible XSS vulnerability in ActionView
- State
- Published
- Severity
- 4.0 Medium
- Published
- Mar 19, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jan 2, 2020
Description
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.0 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N | GitHub_M |
Weaknesses
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected Products
| Product | Versions |
|---|---|
actionviewrails |
|
References
- https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv
- https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a
- [oss-security] 20200319 [CVE-2020-5267] Possible XSS vulnerability in ActionViewmailing-list
- [debian-lts-announce] 20200320 [SECURITY] [DLA 2149-1] rails security updatemailing-list
- openSUSE-SU-2020:0627vendor-advisory
- FEDORA-2020-4dd34860a3vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.