CVE-2020-5267 in ActionView

Resumen

por MITRE

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsable: GitHub, Inc.
• Reservar: 2020-01-02
• Moderación: aceptado
• Artículo: VDB-151929
• CPE: listo
• CWE: CWE-80 (confirmado)
• CVSS: 4.0 (NVD)
• EPSS: 0.01543
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2020-5267
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-5267
• CVE Details: https://www.cvedetails.com/cve/CVE-2020-5267/