CVE-2020-36599
- Source
- https://cve.org/CVERecord?id=CVE-2020-36599
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36599.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-36599
- Aliases
- Downstream
- Published
- 2022-08-18T23:15:08.187Z
- Modified
- 2026-07-08T20:29:03.601488Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the messagekey value.
- References
Affected packages
Git / github.com/omniauth/omniauth
Affected ranges
- Type
- GIT
- Repo
- https://github.com/omniauth/omniauth
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedLast affectedFixed
- Database specific
{ "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ], "cpe": [ "cpe:2.3:a:omniauth:omniauth:*:*:*:*:*:-:*:*", "cpe:2.3:a:omniauth:omniauth:2.0.0:pre.rc1:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "1.9.2" }, { "introduced": "2.0.0-pre\\.rc1" }, { "last_affected": "2.0.0-pre\\.rc1" } ] }
Affected versions
2.*
2.0.0-pre\.rc1
v0.*
v0.0.1
v0.0.3
v0.0.4
v0.1.5
v0.1.6
v0.2.0
v0.2.0.beta1
v0.2.0.beta2
v0.2.0.beta4
v0.2.0.beta5
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v1.*
v1.0.0
v1.0.0.beta1
v1.0.0.pr1
v1.0.0.pr2
v1.0.0.rc1
v1.0.0.rc2
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.6.0
v1.6.1
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v2.*
v2.0.0-rc1