{"affected":[{"affectedData":[{"product":"actionview","vendor":"rails","versions":[{"status":"affected","version":"< 5.2.4.2"},{"status":"affected","version":">= 6.0.0, < 6.0.2.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:rubyonrails:actionview:*:*:*:*:*:*:*:*","matchCriteriaId":"E64E2A2D-571A-49FD-8AFC-8F7586DEF927","versionEndExcluding":"5.2.4.2","vulnerable":true},{"criteria":"cpe:2.3:a:rubyonrails:actionview:*:*:*:*:*:*:*:*","matchCriteriaId":"611EB0D1-EFBD-4CFA-8BA6-4D0FAA6D787E","versionEndExcluding":"6.0.2.2","versionStartIncluding":"6.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43","vulnerable":true},{"criteria":"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","matchCriteriaId":"E460AA51-FCDA-46B9-AE97-E6676AA5E194","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*","matchCriteriaId":"B620311B-34A3-48A6-82DF-6F078D7A4493","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2."},{"lang":"es","value":"En ActionView versiones anteriores a 6.0.2.2 y 5.2.4.2, se presenta una posible vulnerabilidad de tipo XSS en los asistentes de escape literal de JavaScript de ActionView. Las vistas que usan los métodos \"j\" o \"escape_javascript\" pueden ser susceptibles a ataques de tipo XSS. El problema es corregido en las versiones 6.0.2.2 y 5.2.4.2."}],"id":"CVE-2020-5267","lastModified":"2026-06-17T03:21:10.023","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":3.5,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":6.8,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-03-19T18:15:16.023","references":[{"source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.html"},{"source":"security-advisories@github.com","tags":["Exploit","Mailing List","Patch","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2020/03/19/1"},{"source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Third Party Advisory"],"url":"https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv"},{"source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00022.html"},{"source":"security-advisories@github.com","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Patch","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2020/03/19/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"],"url":"https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00022.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}