PT-2023-11814 · Unknown · Jamesmartin Inline Svg

117Jamesmartin · Published 2023-01-07 · Updated 2024-05-17 · CVE-2020-36644

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jamesmartin Inline SVG versions up to 1.7.1

Description A vulnerability has been found in the component URL Parameter Handler, specifically in the file lib/inline svg/action view/helpers.rb. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely.

Recommendations For jamesmartin Inline SVG versions up to 1.7.1, upgrade to version 1.7.2 to address this issue. As a temporary workaround, consider restricting access to the vulnerable component URL Parameter Handler until the upgrade is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-36644

GHSA-P33Q-4H4M-J994

Affected Products

Jamesmartin Inline Svg

References · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/inline_svg/CVE-2020-36644.yml · Exploit
• https://github.com/jamesmartin/inline_svg/commit/f5363b351508486021f99e083c92068cf2943621 · Patch
• https://github.com/jamesmartin/inline_svg/pull/117 · Patch
• https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2 · Patch
• https://osv.dev/vulnerability/CVE-2020-36644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36644 · Security Note
• https://osv.dev/vulnerability/GHSA-p33q-4h4m-j994 · Vendor Advisory
• https://github.com/jamesmartin/inline_svg · Note
• https://vuldb.com/?ctiid.217597 · Note
• https://t.me/cvenotify/41477 · Telegram Post
• https://vuldb.com/?id.217597 · Note
• https://t.me/cibsecurity/56111 · Telegram Post
• https://t.me/cvenotify/60661 · Telegram Post