Oxidized Web vulnerable to Cross-site Scripting

TRUNG BÌNH 5.4CVE-2019-25088 · GHSA-8qwh-rm6c-jv96 · Công bố 27/12/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2019-25088 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng oxidized-web, oxidized web (oxidized web project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.58%, cao hơn 47.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2019-07-01 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
oxidized-web RubyGems	`≤ 0.13.1`	Chưa có bản vá
oxidized web oxidized_web_project	`< 2019-07-01`	`2019-07-01`

Mô tả

A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.

Mô tả của NVD

A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.