PT-2022-9019 · Ahorner · Text-Helpers

N00Dle · Published 2022-12-22 · Updated 2024-05-17 · CVE-2020-36624

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ahorner text-helpers versions up to 1.0.x ahorner text-helpers versions 1.1.0 through 1.1.1

Description A critical issue affects the unknown code of the file lib/text helpers/translation.rb. The manipulation of the link argument leads to the use of a web link to an untrusted target with window.opener access. The attack can be initiated remotely.

Recommendations For versions up to 1.0.x, upgrade to version 1.1.0 to address this issue. For versions 1.1.0 through 1.1.1, upgrade to version 1.2.0 to address this issue. As a temporary workaround, consider restricting the use of the link argument in the affected component until a patch is available.

Exploit

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

CWE-1022

Related Identifiers

CVE-2020-36624

GHSA-74HC-57M5-83CH

Affected Products

Text-Helpers

References · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/text_helpers/CVE-2020-36624.yml · Exploit
• https://github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3 · Patch
• https://github.com/ahorner/text-helpers/pull/19 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36624 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36624 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-74hc-57m5-83ch · Vendor Advisory
• https://github.com/ahorner/text-helpers/releases/tag/v1.2.0 · Note
• https://github.com/ahorner/text-helpers · Note
• https://github.com/ahorner/text-helpers/releases/tag/v1.1.0 · Note
• https://vuldb.com/?id.216520 · Note
• https://t.me/cibsecurity/55108 · Telegram Post
• https://t.me/cvenotify/40411 · Telegram Post
• https://t.me/cvenotify/40618 · Telegram Post