CVE-2020-5267: Possible XSS vulnerability in ActionView
Vulnerability summary
CVE-2020-5267 is a medium (CVSS 4.8) vulnerability in debian debian_linux. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.6% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 6Timeline
- 19-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA4.0MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.52%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.52% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundRails
Maturity: poc
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web PageThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
- CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Known conditions: network-reachable, administrative account, user interaction (CVSS vector). Other conditions: not stated in public data.
Suse5 products
- rubygem-actionview-4_2&distro=SUSE OpenStack Cloud 7< 4.2.9-9.6.1
- rubygem-actionview-4_2&distro=SUSE OpenStack Cloud Crowbar 8< 4.2.9-9.6.1
- rubygem-actionview-4_2&distro=SUSE OpenStack Cloud Crowbar 9< 4.2.9-9.6.1
- rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15< 5.1.4-3.3.1
- rubygem-actionview-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP1< 5.1.4-3.3.1
Debian2 products
- rails< 2:4.1.8-1+deb8u6 | < 2:5.2.4.1+dfsg-2
- debian_linuxEOL8.0
Opensuse2 products
- leapEOL15.1
- rubygem-actionview-5_1&distro=openSUSE Leap 15.1< 5.1.4-lp151.3.3.1
Fedoraproject1 product
- fedoraEOL33
Rails1 product
- actionview< 5.2.4.2 | ≥ 6.0.0, < 6.0.2.2
RubyGems1 product
- actionview< 5.2.4.2 | ≥ 6.0.0, < 6.0.2.2
Rubyonrails1 product
- actionview< 5.2.4.2 | ≥ 6.0.0, < 6.0.2.2
Ubuntu1 product
- railsAll versions (No fix recorded)
8 vendors · 14 products
References
19 links- github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hvX Refsource CONFIRMREPORTWEBExploitPatchThird Party Advisory
- github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9aX Refsource MISCREPORTWEBPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2020/03/19/1Mailing ListX Refsource MLISTREPORTWEBExploitPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2020/03/msg00022.htmlMailing ListX Refsource MLISTREPORTWEBThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
Show all 19 references
- lists.opensuse.org/archives/…Advisory
