Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-20975

CVE-2018-20975: Cross-site scripting in fat_free_crm

6.1

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-20975
GHSA ID
GHSA-4p8f-mmfj-r45g
EPSS Score
0.53005%
CWE
CWE-79
Published
8/21/2019
Updated
8/25/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
fat_free_crmrubygems< 0.18.10.18.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit 6d60bc8 explicitly shows the addition of escape_javascript(query) to sanitize the 'query' parameter in tags_helper.rb. The unescaped interpolation of 'query' into a JavaScript context (crm.search_tagged) in the original code would allow attackers to inject arbitrary scripts. The CVE description and patch context confirm this was the XSS vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**t *r** *RM ***or* *.**.* **s XSS in t** `t**s_**lp*`r in `*pp/**lp*rs/t**s_**lp*r.r*`.

Reasoning

T** *ommit ******* *xpli*itly s*ows t** ***ition o* *s**p*_j*v*s*ript(qu*ry) to s*nitiz* t** 'qu*ry' p*r*m*t*r in t**s_**lp*r.r*. T** un*s**p** int*rpol*tion o* 'qu*ry' into * J*v*S*ript *ont*xt (*rm.s**r**_t*****) in t** ori*in*l *o** woul* *llow *t