CVE-2020-5267CWE-80

Possible XSS vulnerability in ActionView

Medium · published March 19, 2020

CVSS v3.1
4.0
EPSS
2%
Percentile
74.5
In the wild
Unconfirmed
What it is

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01525 · 74.5th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2020-03-19T17:30Z
EPSS history
Timeline
  • 19 MAR 17:30Z
    Possible XSS vulnerability in ActionView
    cvelistv5