PT-2023-11814 · Unknown · Jamesmartin Inline Svg

117Jamesmartin · Publicado 2023-01-07 · Atualizado 2024-05-17 · CVE-2020-36644

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jamesmartin Inline SVG versions up to 1.7.1

Description A vulnerability has been found in the component URL Parameter Handler, specifically in the file lib/inline svg/action view/helpers.rb. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely.

Recommendations For jamesmartin Inline SVG versions up to 1.7.1, upgrade to version 1.7.2 to address this issue. As a temporary workaround, consider restricting access to the vulnerable component URL Parameter Handler until the upgrade is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2020-36644

GHSA-P33Q-4H4M-J994

Produtos afetados

Jamesmartin Inline Svg

Referências · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/inline_svg/CVE-2020-36644.yml · Exploit
• https://github.com/jamesmartin/inline_svg · Nota
• https://github.com/jamesmartin/inline_svg/commit/f5363b351508486021f99e083c92068cf2943621 · Correção
• https://github.com/jamesmartin/inline_svg/pull/117 · Correção
• https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2 · Correção
• https://osv.dev/vulnerability/CVE-2020-36644 · Aviso do Fabricante
• https://vuldb.com/?ctiid.217597 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-36644 · Nota de Segurança
• https://t.me/cvenotify/41477 · Publicação no Telegram
• https://vuldb.com/?id.217597 · Nota
• https://osv.dev/vulnerability/GHSA-p33q-4h4m-j994 · Aviso do Fabricante
• https://t.me/cibsecurity/56111 · Publicação no Telegram
• https://t.me/cvenotify/60661 · Publicação no Telegram