CVE:CVE-2020-5267
CNNVD:CNNVD-202003-1221
ActionView是一套开源的问题需求跟踪工具。该产品支持权限配置、统计报表、文档分享和工作日志等功能。
ActionView 6.0.2.2之前版本和5.2.4.2中的JavaScript文字转义助手存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade rubyonrails actionview to a higher version than 5.2.4.2,6.0.2.2,and avoid the version (,5.2.4.2),[6.0.0,6.0.2.2); Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade fedoraproject fedora to a higher version than 33,and avoid the version 33; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1