CVE-2020-15169
published 2020-09-11CVE-2020-15169: In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
2.37%
82.0th percentile
In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| action_view_project | action_view | < 5.2.4.4 | 5.2.4.4 |
| action_view_project | action_view | >= 6.0.0.0 < 6.0.3.3 | 6.0.3.3 |
| debian | debian_linux | — | — |
| debian | rails | < rails 2:6.0.3.3+dfsg-1 (bookworm) | rails 2:6.0.3.3+dfsg-1 (bookworm) |
| fedoraproject | fedora | — | — |
| rails | actionview | < 5.2.4.4 | 5.2.4.4 |
| rails | actionview | — | — |
| rails | actionview | >= 0 < 5.2.4.4 | 5.2.4.4 |
| rails | actionview | >= 6.0.0.0 < 6.0.3.3 | 6.0.3.3 |
| rubyonrails | rails | >= 0 < 2:6.0.3.3+dfsg-1 | 2:6.0.3.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.3+dfsg-1 | 2:6.0.3.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.3+dfsg-1 | 2:6.0.3.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.3+dfsg-1 | 2:6.0.3.3+dfsg-1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2020-15169: In Action View before versions 5
osv·2020-09-11·CVSS 6.1
CVE-2020-15169 [MEDIUM] CVE-2020-15169: In Action View before versions 5
In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
OSV
XSS in Action View
osv·2020-09-11
CVE-2020-15169 [MEDIUM] XSS in Action View
XSS in Action View
There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks.
### Impact
When an HTML-unsafe string is passed as the default for a missing translation key [named `html` or ending in `_html`](https://guides.rubyonrails.org/i18n.html#using-safe-html-translations), the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:
```erb
```
### Patches
Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.
The patches have also been applied to the `master`, `6-0-stable`, and `5-2-stable` branches on Git
GHSA
XSS in Action View
ghsa·2020-09-11
CVE-2020-15169 [MEDIUM] CWE-79 XSS in Action View
XSS in Action View
There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks.
### Impact
When an HTML-unsafe string is passed as the default for a missing translation key [named `html` or ending in `_html`](https://guides.rubyonrails.org/i18n.html#using-safe-html-translations), the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:
```erb
```
### Patches
Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.
The patches have also been applied to the `master`, `6-0-stable`, and `5-2-stable` branches on Git
Red Hat
rubygem-activeview: Cross-site scripting in translation helpers
vendor_redhat·2020-09-09·CVSS 5.4
CVE-2020-15169 [MEDIUM] CWE-79 rubygem-activeview: Cross-site scripting in translation helpers
rubygem-activeview: Cross-site scripting in translation helpers
In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
A flaw was found in rubygem-actionview in versions prior to 5.2.4.4 and 6.0.3.3. When an HTML-unsafe string is passed as the default for a missi
Debian
CVE-2020-15169: rails - In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Si...
vendor_debian·2020·CVSS 5.4
CVE-2020-15169 [MEDIUM] CVE-2020-15169: rails - In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Si...
In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
Scope: local
bookworm: resolved (fixed in 2:6.0.3.3+dfsg-1)
bullseye: resolved (fixed in 2:6.0.3.3+dfsg-1)
forky: resolved (fixed in 2:6.0.3.3+dfsg-1)
sid: resolved (fixed in 2:6.0.3.3+dfsg-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
HackerOne
XSS when using `translate` in Action Controller (Rails 7.0, 7.1)
hackerone·2024-10-01·CVSS 5.4
[MEDIUM] XSS when using `translate` in Action Controller (Rails 7.0, 7.1)
XSS when using `translate` in Action Controller (Rails 7.0, 7.1)
I have confirmed two ways that XSS can occur when using `translate` in Action Controller. ( https://github.com/rails/rails/blob/v7.1.2/actionpack/lib/abstract_controller/translation.rb#L15 )
This does not occur in Action View because the implementation of `tanslate` is different. ( https://github.com/rails/rails/blob/v7.1.2/actionview/lib/action_view/helpers/translation_helper.rb#L73 )
One is when the key value contains `_html` and also contains the tag value.
XSS is possible because the error message returned by `I18n` contains the value of key and is marked as `html_safe`.
https://github.com/rails/rails/blob/v7.1.2/activesupport/lib/active_support/html_safe_translation.rb#L35
The other case is when the key value contain
Bugzilla
CVE-2020-15169 rubygem-activeview: Cross-site scripting in translation helpers
bugzilla·2020-09-09·CVSS 5.4
CVE-2020-15169 [MEDIUM] CVE-2020-15169 rubygem-activeview: Cross-site scripting in translation helpers
CVE-2020-15169 rubygem-activeview: Cross-site scripting in translation helpers
A flaw was found in rubygem-actionview before versions 5.2.4.4 and 6.0.3.3. When an HTML-unsafe string is passed as the default for a missing translation key, the default string is incorrectly marked as HTML-safe and not escaped.
References:
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-15169.yml
https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc?pli=1
Discussion:
Created rubygem-actionview tracking bugs for this issue:
Affects: fedora-all [bug 1877568]
---
Technical information: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc?pli=1
Upstream patch: https://github.com/rails/rails/commit/e663f084460ea56c55c3dc76f78c7caeddeeb02e
---
External Re
Bugzilla
CVE-2020-15169 rubygem-actionview: rubygem-activeview: Cross-site scripting in translation helpers [fedora-all]
bugzilla·2020-09-09·CVSS 5.4
CVE-2020-15169 [MEDIUM] CVE-2020-15169 rubygem-actionview: rubygem-activeview: Cross-site scripting in translation helpers [fedora-all]
CVE-2020-15169 rubygem-actionview: rubygem-activeview: Cross-site scripting in translation helpers [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue a
https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5https://lists.debian.org/debian-lts-announce/2020/10/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/https://www.debian.org/security/2020/dsa-4766https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5https://lists.debian.org/debian-lts-announce/2020/10/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/https://www.debian.org/security/2020/dsa-4766
2020-09-11
Published