« Volver al listado

CVE-2020-5241

Estado: ModificadaMedia (5.4)—

matestack-ui-core (RubyGem) versiones anteriores a 0.7.4, es vulnerable a un ataque de tipo XSS y a una inyección de Script. Esta vulnerabilidad está parchada en la versión 0.7.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Fuente: mapeo oficial MITRE CTID (CVE → ATT&CK).

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingUser Account ManagementRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationExecution Prevention

Tecnologías afectadas (1)

Matestack — Ui-core

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-5241",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "matestack",
          "product": "matestack-ui-core",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.7.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-13T00:15:11.497",
  "references": [
    {
      "url": "https://github.com/matestack/matestack-ui-core/security/advisories/GHSA-3jqw-vv45-mjhh",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/matestack/matestack-ui-core/security/advisories/GHSA-3jqw-vv45-mjhh",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4."
    },
    {
      "lang": "es",
      "value": "matestack-ui-core (RubyGem) versiones anteriores a 0.7.4, es vulnerable a un ataque de tipo XSS y a una inyección de Script. Esta vulnerabilidad está parchada en la versión 0.7.4."
    }
  ],
  "lastModified": "2026-06-17T03:21:06.790",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:matestack:ui-core:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90597F30-4CFD-4629-A64C-20EC9D6407C9",
              "versionEndExcluding": "0.7.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}