CVE-2020-14001 — Missing Authorization in Project Kramdown

CWE-862 — Missing AuthorizationCWE-20 — Improper Input ValidationCWE-77 — Command InjectionCWE-552 — Files or Directories Accessible to External Parties13 documents9 sources
Severity
9.8CRITICALNVD
EPSS
9.3%
top 7.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Kramdown Project KramdownCanonical Ubuntu LinuxDebian Linux+1 more
Timeline
PublishedJul 17
Latest updateOct 26

Description

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶RubyGemskramdown_project/kramdown< 2.3.0

Also affects: Debian Linux 10.0, 9.0, Fedora 31, 32, Ubuntu Linux 20.04

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Unintended read access in kramdown gem↗2020-08-07
▶
GHSA
Unintended read access in kramdown gem↗2020-08-07
▶
CVEList
CVE-2020-14001: The kramdown gem before 2↗2020-07-17
▶
OSV
CVE-2020-14001: The kramdown gem before 2↗2020-07-17
▶

📋Vendor Advisories

5
Ubuntu
kramdown vulnerability↗2020-10-26
▶
Ubuntu
kramdown vulnerability↗2020-09-30
▶
GitLab
CVE-2020-14001: The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such a↗2020-07-17
▶
Red Hat
rubygem-kramdown: processing template options inside documents allows unintended read access or embedded Ruby code execution↗2020-06-27
▶
Debian
CVE-2020-14001: ruby-kramdown - The kramdown gem before 2.3.0 for Ruby processes the template option inside Kram...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-14001 rubygem-kramdown: processing template options inside documents allows unintended read access or embedded Ruby code execution↗2020-07-17
▶
Bugzilla
CVE-2020-14001 rubygem-kramdown: processing template options inside documents allows unintended read access or embedded Ruby code execution [epel-7]↗2020-07-17
▶
Bugzilla
CVE-2020-14001 rubygem-kramdown: processing template options inside documents allows unintended read access or embedded Ruby code execution [fedora-all]↗2020-07-17
▶
CVE-2020-14001 — Missing Authorization | cvebase