CVE-2020-11082
published 2020-05-28CVE-2020-11082: In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.51%
71.9th percentile
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | ruby-kaminari | < ruby-kaminari 1.0.1-6 (bookworm) | ruby-kaminari 1.0.1-6 (bookworm) |
| kaminari | kaminari | < 1.2.1 | 1.2.1 |
| kaminari | kaminari | >= 0 < 1.2.1 | 1.2.1 |
| kaminari_project | kaminari | < 1.2.1 | 1.2.1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Cross-Site Scripting in Kaminari
ghsa·2020-05-28
CVE-2020-11082 [MEDIUM] CWE-79 Cross-Site Scripting in Kaminari
Cross-Site Scripting in Kaminari
### Impact
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
### Releases
The 1.2.1 gem including the patch has already been released.
All past released versions are affected by this vulnerability.
### Workarounds
Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.
```ruby
module Kaminari::Helpers
PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end
```
### Credits
Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.
OSV
CVE-2020-11082: In Kaminari before 1
osv·2020-05-28·CVSS 6.1
CVE-2020-11082 [MEDIUM] CVE-2020-11082: In Kaminari before 1
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
OSV
Cross-Site Scripting in Kaminari
osv·2020-05-28
CVE-2020-11082 [MEDIUM] Cross-Site Scripting in Kaminari
Cross-Site Scripting in Kaminari
### Impact
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
### Releases
The 1.2.1 gem including the patch has already been released.
All past released versions are affected by this vulnerability.
### Workarounds
Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.
```ruby
module Kaminari::Helpers
PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end
```
### Credits
Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.
Debian
CVE-2020-11082: ruby-kaminari - In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker ...
vendor_debian·2020·CVSS 6.4
CVE-2020-11082 [MEDIUM] CVE-2020-11082: ruby-kaminari - In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker ...
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
Scope: local
bookworm: resolved (fixed in 1.0.1-6)
bullseye: resolved (fixed in 1.0.1-6)
forky: resolved (fixed in 1.0.1-6)
sid: resolved (fixed in 1.0.1-6)
trixie: resolved (fixed in 1.0.1-6)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/github/advisory-review/pull/1020https://github.com/kaminari/kaminari/commit/8dd52a1aed3d2fa2835d836de23fc0d8c4ff5db8https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433https://lists.debian.org/debian-lts-announce/2021/09/msg00011.htmlhttps://www.debian.org/security/2021/dsa-5005https://github.com/github/advisory-review/pull/1020https://github.com/kaminari/kaminari/commit/8dd52a1aed3d2fa2835d836de23fc0d8c4ff5db8https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433https://lists.debian.org/debian-lts-announce/2021/09/msg00011.htmlhttps://www.debian.org/security/2021/dsa-5005
2020-05-28
Published