Home > Vulnerability Database > CVE-2020-36599

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2020-36599

Good to know:

Date: August 18, 2022

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

Language: Ruby

Severity Score

9.8

Related Resources (7)

Url: https://rubygems.org/gems/omniauth/versions/1.9.2

Url: https://github.com/omniauth/omniauth

Url: https://security-tracker.debian.org/tracker/CVE-2020-36599

Url: https://github.com/omniauth/omniauth/commit/43a396f181ef7d0ed2ec8291c939c95e3ed3ff00#diff-575abda9deb9b1a77bf534e898a923029b9a61e991d626db88dc6e8b34260aa2

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth/CVE-2020-36599.yml

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-36599

Url: https://www.mend.io/vulnerability-database/CVE-2020-36599

Severity Score

9.8

Weakness Type (CWE)

Improper Encoding or Escaping of Output

CWE-116

Top Fix

Upgrade Version

Upgrade to version omniauth - 1.9.2;omniauth - 2.0.0

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us