CVE-2020-15169

XSS in Action View

Published Sep 11, 2020 CVSS 3.1 · 5.4 Medium EPSS 2.4% KEV · Not listed
Description
In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2403-1 rails security update
Debian DSA Debian DSA DSA-4766-1 rails security update
EUVD EUVD EUVD-2020-0979 In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
Github GHSA Github GHSA GHSA-cfjv-5498-mph5 XSS in Action View
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Aug 4, 2024, 1:08 PM
Reserved
Jun 25, 2020, 12:00 AM
Status
Modified
Published
Sep 11, 2020, 4:15 PM
Modified
Jun 17, 2026, 2:56 AM
Severity
Moderate
Public date
Sep 9, 2020, 12:00 AM