CVE-2020-35305: Gollum Cross-site Scripting vulnerability… – CVSS 6.1 · Watchpost

← All vulnerabilities

Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog

中危 6.1CVE-2020-35305 · GHSA-fj2w-qmjp-3rjm · Published 15/07/2022 · updated 09/07/2026

要点

CVE-2020-35305 是影响 gollum, gollum (gollum project) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.79%，高于 56.5% 的漏洞。
修复：升级到 5.1.2 或更高版本。

Package	Affected versions	Patched versions
gollum RubyGems	`≥ 5.0, < 5.1.2`	`5.1.2`
gollum gollum_project	`≥ 5.0.0, ≤ 5.1.2`	No fix yet

Description

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

NVD description

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

References

nvd.nist.gov/vuln/detail/CVE-2020-35305 · ADVISORY
gollum/gollum commit 137728c · WEB
github.com/Szarny · WEB
github.com/gollum · WEB
gollum/gollum · PACKAGE
gollum/gollum release v5.1.2 · WEB
rubysec/ruby-advisory-db · WEB
gollum.com · WEB
github.com/Szarny · Not Applicable
github.com/gollum · Product

gollum 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free