CVE-2020-5267 in ActionView

Sumário

de MITRE

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsável: GitHub, Inc.
• Reservar: 02/01/2020
• Moderação: aceite
• Entrada: VDB-151929
• CPE: pronto
• CWE: CWE-80 (confirmado)
• CVSS: 4.0 (NVD)
• EPSS: 0.01543
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2020-5267
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-5267
• CVE Details: https://www.cvedetails.com/cve/CVE-2020-5267/