medium6.1
CVE-2020-35305
Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog
Impact
Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | gollum | >= 5.0, < 5.1.2 | 5.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gollum Project | Gollum | from 5.0.0 through 5.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Szarny/
- https://github.com/gollum/
- https://github.com/gollum/gollum/releases/tag/v5.1.2
- https://github.com/advisories/GHSA-fj2w-qmjp-3rjm
- https://nvd.nist.gov/vuln/detail/CVE-2020-35305
- http://gollum.com
- https://github.com/gollum/gollum/commit/137728cdabc0f60859fcd30404ad2b8fff6ef715
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/gollum/CVE-2020-35305.yml