CVE-2020-25739

Katalog CVE

CVSS 6.1 · Medium EPSS 1,4%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada gon project gon, canonical ubuntu linux +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.

Rincian

Terbit di NVD

23 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gazay/gon/commit/fe3c7b2191a992386dc9edd37de5447a4e809bc7 patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/09/msg00018.html mailing list · advisory pihak ketiga
• https://usn.ubuntu.com/4560-1/ advisory pihak ketiga