CVE-2020-26247

CVSS V2 Medium 4 CVSS V3 Medium 4.3
Description
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
Overview
  • CVE ID
  • CVE-2020-26247
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2020-12-30T19:15:12
  • Last Modified Date
  • 2022-10-19T18:53:09
Weakness Enumerations
CWE URL
CWE-611 http://cwe.mitre.org/data/definitions/611.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:* 1 OR 1.11.0
cpe:2.3:a:nokogiri:nokogiri:1.11.0:rc1:*:*:*:ruby:*:* 1 OR
cpe:2.3:a:nokogiri:nokogiri:1.11.0:rc2:*:*:*:ruby:*:* 1 OR
cpe:2.3:a:nokogiri:nokogiri:1.11.0:rc3:*:*:*:ruby:*:* 1 OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:S/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 4
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • LOW
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 2.8
  • Impact Score
  • 1.4
References
Reference URL Reference Tags
https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b Patch Third Party Advisory
https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4 Release Notes Third Party Advisory
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m Mitigation Third Party Advisory
https://hackerone.com/reports/747489 Permissions Required
https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html Mailing List Third Party Advisory
https://rubygems.org/gems/nokogiri Product Third Party Advisory
https://security.gentoo.org/glsa/202208-29 Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2020-26247
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26247
History
Created Old Value New Value Data Type Notes
2022-05-10 16:12:18 Added to TrackCVE
2022-12-05 19:05:06 2020-12-30T19:15Z 2020-12-30T19:15:12 CVE Published Date updated
2022-12-05 19:05:06 2022-10-19T18:53:09 CVE Modified Date updated
2022-12-05 19:05:06 Analyzed Vulnerability Status updated
2022-12-05 19:05:11 References updated