ytti Oxidized Web conf_search.haml cross site scripting
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ytti | Oxidized Web | all versions | — | No fix listed | CNA |
| — | oxidized-web (RubyGems) | up to 0.13.1 | — | No fix listed | GHSA-8qwh-rm6c-jv96 |
- Oxidized Web Vendorytti Affected all versions Fixed in — No fix listed CNA
- oxidized-web (RubyGems) Vendor— Affected up to 0.13.1 Fixed in — No fix listed GHSA-8qwh-rm6c-jv96
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oxidized_web_project:oxidized_web:*:*:*:*:*:oxidized:*:* | before 2019-07-01 | Vulnerable | Oxidized Web project |
- cpe:2.3:a:oxidized_web_project:oxidized_web:*:*:*:*:*:oxidized:*:* Versions before 2019-07-01 Vulnerable ·Oxidized Web project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-25088
- 2026-10-03 Alias added: GHSA-8qwh-rm6c-jv96
References
Patch 2
More Oxidized Web project Oxidized Web vulnerabilities
- TI-2025-20402 Path traversal in Oxidized Web CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-25088 · CVE Program
- CVE-2019-25088 · NVD
- FIRST EPSS
- GHSA-8qwh-rm6c-jv96 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences