Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03NGhjLTU3bTUtODNjaM4AAwgl

text_helpers uses web link to untrusted target with window.opener access

A vulnerability was found in ahorner text-helpers 1.1.0/1.1.1. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.2.0 can address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.

Permalink: https://github.com/advisories/GHSA-74hc-57m5-83ch
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NGhjLTU3bTUtODNjaM4AAwgl
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-74hc-57m5-83ch, CVE-2020-36624
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-36624
• https://github.com/ahorner/text-helpers/pull/19
• https://github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3
• https://github.com/ahorner/text-helpers/releases/tag/v1.2.0
• https://vuldb.com/?id.216520
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/text_helpers/CVE-2020-36624.yml
• https://github.com/ahorner/text-helpers/releases/tag/v1.1.0
• https://github.com/advisories/GHSA-74hc-57m5-83ch

Repository: https://github.com/ahorner/text-helpers
Blast Radius: 4.3

Affected Packages