CVE-2020-14001

Katalog CVE

CVSS 9.8 · Critical EPSS 4,6%

Kerentanan Missing Authorization pada kramdown project kramdown, debian linux +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Rincian

Terbit di NVD

17 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

4,6% peluang dieksploitasi; lebih tinggi dari 91,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kramdown.gettalong.org advisory vendor
• https://kramdown.gettalong.org/news.html release notes · advisory vendor
• https://github.com/gettalong/kramdown/commit/1b8fd33c3120bfc6e5164b449e2c2fc9c9306fde patch · advisory pihak ketiga
• https://github.com/gettalong/kramdown/compare/REL_2_2_1...REL_2_3_0 patch · advisory pihak ketiga
• https://github.com/gettalong/kramdown advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/08/msg00014.html mailing list · advisory pihak ketiga
• https://rubygems.org/gems/kramdown advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200731-0004/ advisory pihak ketiga
• https://usn.ubuntu.com/4562-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4743 advisory pihak ketiga
• https://lists.apache.org/thread.html/r96df7899fbb456fe2705882f710a0c8e8614b573fbffd8d12e3f54d2%40%3Cnotificati...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENMMGKHRQIZ3Q...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBLTGBYU7NKOU...