CVE-2020-5267
published 2020-03-19CVE-2020-5267: In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the…
PriorityP421medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
1.54%
72.2th percentile
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | rails | < rails 2:5.2.4.1+dfsg-2 (bookworm) | rails 2:5.2.4.1+dfsg-2 (bookworm) |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
| rails | actionview | < 5.2.4.2 | 5.2.4.2 |
| rails | actionview | — | — |
| rails | actionview | >= 0 < 5.2.4.2 | 5.2.4.2 |
| rails | actionview | >= 6.0.0 < 6.0.2.2 | 6.0.2.2 |
| rubyonrails | actionview | < 5.2.4.2 | 5.2.4.2 |
| rubyonrails | actionview | >= 6.0.0 < 6.0.2.2 | 6.0.2.2 |
| rubyonrails | rails | >= 0 < 2:5.2.4.1+dfsg-2 | 2:5.2.4.1+dfsg-2 |
| rubyonrails | rails | >= 0 < 2:5.2.4.1+dfsg-2 | 2:5.2.4.1+dfsg-2 |
| rubyonrails | rails | >= 0 < 2:5.2.4.1+dfsg-2 | 2:5.2.4.1+dfsg-2 |
| rubyonrails | rails | >= 0 < 2:5.2.4.1+dfsg-2 | 2:5.2.4.1+dfsg-2 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv4.8MEDIUM
vendor_debian4.0MEDIUM
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
vendor_redhat·2020-03-19·CVSS 4.0
CVE-2020-5267 [MEDIUM] CWE-79 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
A flaw was found in rubygem-actionview. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks with ActionView's JavaScript literal escape helpers. The highest threat from this vulnerability is to data confidentiality and integrity.
Statement: Red Hat CloudForms and Satellite ship affected RubyGem actionview with methods, however, those are not vulnerable since none of those
Debian
CVE-2020-5267: rails - In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulne...
vendor_debian·2020·CVSS 4.0
CVE-2020-5267 [MEDIUM] CVE-2020-5267: rails - In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulne...
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
Scope: local
bookworm: resolved (fixed in 2:5.2.4.1+dfsg-2)
bullseye: resolved (fixed in 2:5.2.4.1+dfsg-2)
forky: resolved (fixed in 2:5.2.4.1+dfsg-2)
sid: resolved (fixed in 2:5.2.4.1+dfsg-2)
trixie: resolved (fixed in 2:5.2.4.1+dfsg-2)
OSV
Cross site scripting vulnerability in ActionView
osv·2020-03-19
CVE-2020-5267 [MEDIUM] Cross site scripting vulnerability in ActionView
Cross site scripting vulnerability in ActionView
There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks.
### Impact
There is a possible XSS vulnerability in the `j` and `escape_javascript` methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this:
```erb
let a = ``
```
or
```erb
let a = ``
```
### Releases
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
### Workarounds
For those that can't upgrade, the following monkey patch may be used:
```ruby
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
mo
OSV
CVE-2020-5267: In ActionView before versions 6
osv·2020-03-19·CVSS 4.8
CVE-2020-5267 [MEDIUM] CVE-2020-5267: In ActionView before versions 6
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
GHSA
Cross site scripting vulnerability in ActionView
ghsa·2020-03-19
CVE-2020-5267 [MEDIUM] CWE-80 Cross site scripting vulnerability in ActionView
Cross site scripting vulnerability in ActionView
There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks.
### Impact
There is a possible XSS vulnerability in the `j` and `escape_javascript` methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this:
```erb
let a = ``
```
or
```erb
let a = ``
```
### Releases
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
### Workarounds
For those that can't upgrade, the following monkey patch may be used:
```ruby
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
mo
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all]
bugzilla·2020-05-05·CVSS 4.0
CVE-2020-5267 [MEDIUM] CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all]
CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all]
bugzilla·2020-05-05·CVSS 4.0
CVE-2020-5267 [MEDIUM] CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all]
CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
bugzilla·2020-05-05·CVSS 4.0
CVE-2020-5267 [MEDIUM] CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
There is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks.
External Reference:
https://www.openwall.com/lists/oss-security/2020/03/19/1
Discussion:
Created rubygem-actionview tracking bugs for this issue:
Affects: fedora-all [bug 1831531]
---
Statement:
Red Hat CloudForms and Satellite ship affected RubyGem actionview with methods, however, those are not vulnerable since none of those uses template string enclosed with backtick characters. A future update may fix affected RubyGem.
---
This issue has been addressed in the following products:
Red
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.htmlhttp://www.openwall.com/lists/oss-security/2020/03/19/1https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9ahttps://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hvhttps://lists.debian.org/debian-lts-announce/2020/03/msg00022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.htmlhttp://www.openwall.com/lists/oss-security/2020/03/19/1https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9ahttps://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hvhttps://lists.debian.org/debian-lts-announce/2020/03/msg00022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
2020-03-19
Published