Every CVE Search/ Get API key

CVE-2020-11082

Cross-Site Scripting in Kaminari

6.4 MediumFix available

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
Low

Exploit likelihood

1.55%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.4

Cross-Site Scripting in Kaminari

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Record
CVE-2020-11082
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2020-0441 6.4

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Record
EUVD-2020-0441
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-r5jw-62xg-j433 6.4

Cross-Site Scripting in Kaminari

Impact

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Releases

The 1.2.1 gem including the patch has already been released. All past released versions are affected by this vulnerability.

Workarounds

Application developers who can't update the gem can workaround by overriding the PARAM_KEY_EXCEPT_LIST constant.

module Kaminari::Helpers
  PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end

Credits

Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.

Record
GHSA-r5jw-62xg-j433
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
NVD 6.4

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Record
CVE-2020-11082
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Record
CVE-2020-11082
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-11082 6.1

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Record
DEBIAN-CVE-2020-11082
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-r5jw-62xg-j433 6.4

Cross-Site Scripting in Kaminari

Impact

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Releases

The 1.2.1 gem including the patch has already been released. All past released versions are affected by this vulnerability.

Workarounds

Application developers who can't update the gem can workaround by overriding the PARAM_KEY_EXCEPT_LIST constant.

module Kaminari::Helpers
  PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end

Credits

Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.

Record
GHSA-r5jw-62xg-j433
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2020-11082 6.4

In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

Record
UBUNTU-CVE-2020-11082
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kaminari
RubyGems
 before 1.2.1
1.2.1
ruby-kaminari
Debian:12
 before 1.0.1-6
1.0.1-6
ruby-kaminari
Debian:13
 before 1.0.1-6
1.0.1-6
ruby-kaminari
Debian:14
 before 1.0.1-6
1.0.1-6
ruby-kaminari
Debian:9
 before 0.17.0-3+deb9u1, plus listed versions
0.17.0-3
0.17.0-3+deb9u1
ruby-kaminari
Debian:10
 before 1.0.1-4+deb10u1, plus listed versions
1.0.1-4
1.0.1-4+deb10u1
kaminari
RubyGems
 before 1.2.1, plus listed versions
0.1.00.10.00.10.10.10.20.10.3
Show 45 moreShow less
0.10.40.11.00.12.00.12.10.12.20.12.30.12.40.13.00.14.00.14.10.15.00.15.10.16.00.16.10.16.20.16.30.17.00.2.00.2.10.3.00.4.00.5.00.6.00.6.10.7.00.8.00.9.00.9.10.9.100.9.120.9.130.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.0.beta21.0.0.rc11.0.11.1.01.1.1
1.2.1
ruby-kaminari
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.16.3-1
 None known
ruby-kaminari
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.17.0-3
 None known
ruby-kaminari
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.0.1-41.0.1-5
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-11082 is a medium vulnerability (CVSS 6.4) in Kaminari, published May 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in kaminari 1.2.1.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 1 version. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open