Description
In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
Published: 2020-09-11
Score: 5.4 Medium
EPSS: 1.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-2403-1 rails security update
Debian DSA Debian DSA DSA-4766-1 rails security update
EUVD EUVD EUVD-2020-0979 In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.
Github GHSA Github GHSA GHSA-cfjv-5498-mph5 XSS in Action View
History

No history.

Subscriptions

Action View Project Action View
Debian Debian Linux
Fedoraproject Fedora
Redhat Satellite Satellite Capsule
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-08-04T13:08:22.436Z

Reserved: 2020-06-25T00:00:00.000Z

Link: CVE-2020-15169

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-09-11T16:15:12.287

Modified: 2024-11-21T05:04:59.650

Link: CVE-2020-15169

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-09-09T00:00:00Z

Links: CVE-2020-15169 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses