6.4
CVE-2020-11082
- EPSS 0.45%
- Published 28.05.2020 21:15:11
- Last modified 21.11.2024 04:56:44
- Source security-advisories@github.com
- CVE-Watchlists
- Open
LoginIn Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
Data is provided by the National Vulnerability Database (NVD)
Kaminari Project ≫ Kaminari Version < 1.2.1
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.45% | 0.629 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
| security-advisories@github.com | 6.4 | 1.6 | 4.7 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.