Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog

MEDIO 6.1CVE-2020-35305 · GHSA-fj2w-qmjp-3rjm · Published 15/07/2022 · updated 09/07/2026

En resumen

CVE-2020-35305 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a gollum, gollum (gollum project).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.79%, mayor que el 56.5% de las vulnerabilidades.
Solución: actualizar a 5.1.2 o posterior.

Package	Affected versions	Patched versions
gollum RubyGems	`≥ 5.0, < 5.1.2`	`5.1.2`
gollum gollum_project	`≥ 5.0.0, ≤ 5.1.2`	No fix yet

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

NVD description

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

RubyGems

≥ 5.0, < 5.1.2

5.1.2

≥ 5.0.0, ≤ 5.1.2

No fix yet

Más vulnerabilidades de gollum

Ver todo →