Vulnerability · Published May 28, 2020 · Assigned by GitHub_M
CVE-2020-11082Cross-Site Scripting in Kaminari
Medium 6.4
In plain English
A medium-severity cross-site scripting in Kaminari from kaminari. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)1.5%top 24.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ruby-kaminari | 1.0.1-6 | DEBIAN-CVE-2020-11082 |
| Debian:13 | ruby-kaminari | 1.0.1-6 | DEBIAN-CVE-2020-11082 |
| Debian:14 | ruby-kaminari | 1.0.1-6 | DEBIAN-CVE-2020-11082 |
| RubyGems | kaminari | 1.2.1 | GHSA-r5jw-62xg-j433 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
References
- https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433 x_refsource_CONFIRM
- https://github.com/github/advisory-review/pull/1020 x_refsource_MISC
- https://github.com/kaminari/kaminari/commit/8dd52a1aed3d2fa2835d836de23fc0d8c4ff5db8 x_refsource_MISC
- [debian-lts-announce] 20210922 [SECURITY] [DLA 2763-1] ruby-kaminari security update mailing-list, x_refsource_MLIST
- DSA-5005 vendor-advisory, x_refsource_DEBIAN