In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
Advisories
Source ID Title
Debian DLA Debian DLA DLA-2403-1 rails security update
Debian DSA Debian DSA DSA-4766-1 rails security update
EUVD EUVD EUVD-2020-0979 In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
Github GHSA Github GHSA GHSA-cfjv-5498-mph5 XSS in Action View
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-08-04T13:08:22.436Z

Reserved: 2020-06-25T00:00:00

Link: CVE-2020-15169

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-09-11T16:15:12.287

Modified: 2024-11-21T05:04:59.650

Link: CVE-2020-15169

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-09-09T00:00:00Z

Links: CVE-2020-15169 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses