« Volver al listado

CVE-2020-5216

Estado: ModificadaMedia (5.8)—

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Twitter — Secure Headers

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-5216",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Twitter",
          "product": "secure_headers",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.9.0"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.2.0"
            },
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.3.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-23T03:15:10.683",
  "references": [
    {
      "url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-113"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0."
    },
    {
      "lang": "es",
      "value": "En Secure Headers (secure_headers de RubyGem), una vulnerabilidad de inyección de directiva está presente en las versiones anteriores a 3.9.0, 5.2.0 y 6.3.0. Si la entrada suministrada por el usuario fue pasada a append/override_content_security_policy_directives, una línea nueva podría ser inyectada conllevando a una inyección de encabezado limitada. Al visualizar una nueva línea en el encabezado, rails creará silenciosamente un nuevo encabezado Content-Security-Policy con el valor restante de la cadena original. Continuará creando nuevos encabezados para cada nueva línea. Esto ha sido corregido en las versiones 6.3.0, 5.2.0 y 3.9.0."
    }
  ],
  "lastModified": "2026-06-17T03:21:02.577",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7C8E5CD-3CF2-439D-991F-EC4F561AF149",
              "versionEndExcluding": "3.9.0"
            },
            {
              "criteria": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EE2D852-886F-4500-8B6A-6CD4313BE0A6",
              "versionEndExcluding": "5.2.0",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C13DFD4-1B3B-4373-9048-82BBB0C594C9",
              "versionEndExcluding": "6.3.0",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}