CVE-2020-15169

Katalog CVE

CVSS 6.1 · Medium EPSS 2,4%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada action view project action view, debian linux +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

Rincian

Terbit di NVD

11 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5 patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/10/msg00015.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4766 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQC...