CVE-2020-5267

Possible XSS vulnerability in ActionView

Published Mar 19, 2020 CVSS 3.1 · 4 Medium EPSS 1.5% KEV · Not listed
Description
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2149-1 rails security update
EUVD EUVD EUVD-2020-0332 In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
Github GHSA Github GHSA GHSA-65cv-r6x7-79hv Cross site scripting vulnerability in ActionView
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Aug 4, 2024, 8:22 AM
Reserved
Jan 2, 2020, 12:00 AM
Status
Modified
Published
Mar 19, 2020, 6:15 PM
Modified
Jun 17, 2026, 3:21 AM
Severity
Moderate
Public date
Mar 19, 2020, 12:00 AM