CVE-2019-25088.yml

---
gem: oxidized-web
cve: 2019-25088
ghsa: 8qwh-rm6c-jv96
url: https://github.com/ytti/oxidized-web/pull/195
title: Oxidized Web vulnerable to Cross-site Scripting
date: 2022-12-27
description: |
  A vulnerability was found in ytti Oxidized Web. It has been classified
  as problematic. Affected is an unknown function of the file `lib/oxidized/web/views/conf_search.haml`.
  The manipulation of the argument `to_research` leads to cross site scripting. It
  is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45.
  It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier
  assigned to this vulnerability.
cvss_v3: 5.4
related:
  url:
    - https://github.com/ytti/oxidized-web/commit/55ab9bdc68b03ebce9280b8746ef31d7fdedcc45
    - https://vuldb.com/?id.216870