{"id":"CVE-2020-15169","published":"2020-09-11T15:50:12Z","modified":"2024-08-04T13:08:22Z","title":"XSS in Action View","vendor":"rails","product":"actionview","tier":"tail","description":{"text":"In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02372,"percentile":0.83781,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5","tags":["x_refsource_CONFIRM"]},{"url":"https://www.debian.org/security/2020/dsa-4766","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00015.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":20.5,"factors":[{"name":"EPSS percentile","points":16.76},{"name":"CVSS severity","points":3.78}]},"vendorSlug":"rails","affectedVersions":[{"vendor":"rails","product":"actionview","versions":["< 5.2.4.4",">= 6.0.0.0, < 6.0.3.3"]}],"affected":[{"ecosystem":"RubyGems","package":"actionview","vulnerableRanges":["<5.2.4.4",">=6.0.0.0, <6.0.3.3"],"patched":["5.2.4.4","6.0.3.3"],"from":["GHSA-cfjv-5498-mph5"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0979","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-5419","published":"2019-03-27","fixed":"6.0.0.beta3","kev":false},{"cve":"CVE-2020-5267","published":"2020-03-19","fixed":"6.0.2.2","kev":false},{"cve":"CVE-2020-8167","published":"2020-06-19","fixed":"6.0.3.1","kev":false,"link":{"from":"CVE-2020-8167","to":"CVE-2020-15169","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"5.2.4.3","toFixed":"5.2.4.4","daysApart":84},{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"6.0.3.1","toFixed":"6.0.3.3","daysApart":84}]}},{"cve":"CVE-2020-15169","published":"2020-09-11","fixed":"6.0.3.3","kev":false},{"cve":"CVE-2022-27777","published":"2022-05-26","fixed":"7.0.2.4","kev":false,"link":{"from":"CVE-2020-15169","to":"CVE-2022-27777","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"5.2.4.4","toFixed":"5.2.7.1","daysApart":622},{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"6.0.3.3","toFixed":"6.0.4.8","daysApart":622}]}},{"cve":"CVE-2023-23913","published":"2025-01-09","fixed":"7.0.4.3","kev":false},{"cve":"CVE-2026-33168","published":"2026-03-23","fixed":"8.1.2.1","kev":false}],"package":"RubyGems:actionview"}}