CVE-2020-4054 Information

Description

In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1 there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize’s \relaxed\ config or a custom config that allows certain elements some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize’s relaxed config or a custom config that allows one or more of the following HTML elements: iframe math noembed noframes noscript plaintext script style svg xmp. Using carefully crafted input an attacker may be able to sneak arbitrary HTML through Sanitize potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Reference

https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9 https://github.com/rgrove/sanitize/releases/tag/v5.2.1 https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m https://usn.ubuntu.com/4543-1/ https://www.debian.org/security/2020/dsa-4730

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

LOW

Base Severity

7.3