text_helpers uses web link to untrusted target with window.opener access

🗓️ 22 Dec 2022 12:30:17Reported by GitHub Advisory DatabaseType

A vulnerability was found in ahorner text-helpers 1.1.0/1.1.1. It allows use of web link to untrusted target with window.opener access, potentially leading to remote attacks. Upgrading to version 1.2.0 can address this issue

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2020-36624	22 Dec 202212:23	–	circl
CNNVD	TextHelpers 安全漏洞	22 Dec 202200:00	–	cnnvd
CVE	CVE-2020-36624	22 Dec 202200:00	–	cve
Cvelist	CVE-2020-36624 ahorner text-helpers translation.rb reverse tabnabbing	22 Dec 202200:00	–	cvelist
EUVD	EUVD-2022-7548	3 Oct 202520:07	–	euvd
NVD	CVE-2020-36624	22 Dec 202210:15	–	nvd
OSV	GHSA-74HC-57M5-83CH text_helpers uses web link to untrusted target with window.opener access	22 Dec 202212:30	–	osv
Prion	Design/Logic Flaw	22 Dec 202210:15	–	prion
Positive Technologies	PT-2022-9019 · Ahorner · Text-Helpers	22 Dec 202200:00	–	ptsecurity
RedhatCVE	CVE-2020-36624	22 May 202517:37	–	redhatcve

Vulners

Node

text_helpersRange1.1.0–1.2.0rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-36624
github	www.github.com/ahorner/text-helpers/pull/19
github	www.github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3
github	www.github.com/ahorner/text-helpers/releases/tag/v1.2.0
vuldb	www.vuldb.com/
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/text_helpers/CVE-2020-36624.yml
github	www.github.com/ahorner/text-helpers/releases/tag/v1.1.0
github	www.github.com/advisories/GHSA-74hc-57m5-83ch

02 Feb 2023 05:06Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.16.1 - 6.3

CVSS 36.3

EPSS0.00324