Lucene search

HackeroneCVELIST:CVE-2019-15587

HistoryOct 22, 2019 - 8:07 p.m.

CVE-2019-15587

2019-10-2220:07:47

CWE-79

hackerone

www.cve.org

5.6 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.1%

JSON

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

CNA Affected

[
  {
    "product": "Loofah (rubygem)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in v2.3.1"
      }
    ]
  }
]

References

github.com/flavorjones/loofah/issues/171

hackerone.com/reports/709009

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP5/

security.netapp.com/advisory/ntap-20191122-0003/

usn.ubuntu.com/4498-1/

www.debian.org/security/2019/dsa-4554