Vulnerability · Published Jan 7, 2023 · Assigned by VulDB
CVE-2020-36644jamesmartin Inline SVG URL Parameter helpers.rb cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in Inline SVG from jamesmartin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inline_svg/action_view/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The identifier of the patch is f5363b351508486021f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | inline_svg | 1.7.2 | GHSA-p33q-4h4m-j994 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jamesmartin | Inline SVG | 1.7.01.7.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- https://vuldb.com/?id.217597 vdb-entry, technical-description
- https://vuldb.com/?ctiid.217597 signature, permissions-required
- https://github.com/jamesmartin/inline_svg/pull/117 issue-tracking
- https://github.com/jamesmartin/inline_svg/commit/f5363b351508486021f99e083c92068cf2943621 patch
- https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2 patch