Cross-site Scripting in Chartkick

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-12732 · ADVISORY
• ankane/chartkick · WEB
• ankane/chartkick · PACKAGE
• ankane/chartkick · WEB

chartkick のその他の脆弱性

• CVE-2020-16254中 6.1The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).
• CVE-2019-18841高 7.3Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.