CVE - CVE-2020-4054

CVE-ID
CVE-2020-4054	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m URL:https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m DEBIAN:DSA-4730 URL:https://www.debian.org/security/2020/dsa-4730 MISC:https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9 URL:https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9 MISC:https://github.com/rgrove/sanitize/releases/tag/v5.2.1 URL:https://github.com/rgrove/sanitize/releases/tag/v5.2.1 UBUNTU:USN-4543-1 URL:https://usn.ubuntu.com/4543-1/
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20191230	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20191230)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)