Oxidized Web vulnerable to Cross-site Scripting

中 5.4CVE-2019-25088 · GHSA-8qwh-rm6c-jv96 · 27/12/2022 公開 · 17/06/2026 更新

要点

CVE-2019-25088 は oxidized-web, oxidized web (oxidized web project) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.58%（全脆弱性の 47.5% より高い）。
対処：2019-07-01 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
oxidized-web RubyGems	`≤ 0.13.1`	修正版なし
oxidized web oxidized_web_project	`< 2019-07-01`	`2019-07-01`

概要

A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.

NVD の説明

A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.