PT-2020-5648 · Ruby On Rails+1 · Action View+1
Jesse Campos
·
Published
2020-03-19
·
Updated
2024-06-15
·
CVE-2020-5267
CVSS v3.1
4.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
ActionView versions prior to 6.0.2.2 and 5.2.4.2
Description
There is a possible cross-site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the
j or escape javascript methods may be susceptible to XSS attacks. The issue is related to insufficient protection measures for web page structures. Exploitation of the vulnerability may allow a remote attacker to impact data integrity.Recommendations
For versions prior to 6.0.2.2 and 5.2.4.2, update to version 6.0.2.2 or 5.2.4.2 to resolve the issue.
As a temporary workaround, consider applying the provided monkey patch to the JavaScriptHelper module.
Restrict the use of the
j and escape javascript methods in views until the issue is resolved.
For those who cannot upgrade immediately, apply the provided patches for the 5.2 and 6.0 series.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Action View
Suse