{"id":"CVE-2020-5241","aliases":["EUVD-2020-0287","GHSA-3jqw-vv45-mjhh"],"status":"published","title":"XSS/Script injection vulnerability in matestack","description":"matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00627,"percentile":0.50529,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2020-02-12T23:37:46Z","modified":"2026-11-10T02:30:19Z","fixes":[{"ecosystem":"RubyGems","package":"matestack-ui-core","fixed_in":["0.7.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"matestack-ui-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.4"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"matestack-ui-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.4"}]}],"versions":["0.6.0","0.7.0","0.7.1","0.7.2","0.7.2.1","0.7.3"]}],"products":[{"vendor":"matestack","product":"matestack-ui-core"},{"vendor":"matestack","product":"ui-core"}],"references":[{"url":"https://github.com/matestack/matestack-ui-core/security/advisories/GHSA-3jqw-vv45-mjhh","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5241","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/matestack-ui-core/CVE-2020-5241.yml","tags":["web"]},{"url":"https://github.com/matestack/matestack-ui-core/commit/5c61571739e860db9ca578fe09ab4733878cb0fc","tags":["web"]},{"url":"https://github.com/matestack/matestack-ui-core/commit/e96915cf20c4fa0571df7fa21e9b09a69be19107","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3jqw-vv45-mjhh"},{"url":"https://github.com/matestack/matestack-ui-core","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-5241","title":"XSS/Script injection vulnerability in matestack","description":"matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4.","status":"published","published":"2020-02-12T23:40:11Z","modified":"2024-08-04T08:22:09.024Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:35:47.56691Z"}],"euvd":[{"id":"EUVD-2020-0287","description":"matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4.","status":"published","published":"2020-02-12T23:40:11Z","modified":"2024-08-04T08:22:09Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:08:07.28588Z"}],"ghsa":[{"id":"GHSA-3jqw-vv45-mjhh","title":"XSS/Script injection vulnerability in matestack","description":"matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection.\n\nThis vulnerability is patched in version 0.7.4.","status":"published","published":"2020-02-12T23:37:46Z","modified":"2023-05-22T18:25:18Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:36:53.103029Z"}],"nvd":[{"id":"CVE-2020-5241","description":"matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4.","status":"published","published":"2020-02-13T00:15:11.497Z","modified":"2026-06-17T03:21:06.79Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-80","CWE-79"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"CVE-2020-5241","description":"matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4.","status":"published","published":"2020-02-13T00:15:11.497Z","modified":"2026-11-10T02:30:19.004960177Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-10T02:46:04.118339Z"},{"id":"GHSA-3jqw-vv45-mjhh","title":"XSS/Script injection vulnerability in matestack","description":"matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection.\n\nThis vulnerability is patched in version 0.7.4.","status":"published","published":"2020-02-12T23:37:46Z","modified":"2026-09-10T03:48:42.859630871Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}