CVE-2020-36624
CVE-2020-36624 is a medium-severity vulnerability in Texthelpers Project Texthelpers with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1022.
Key facts
- Severity: Medium (CVSS 3.x base score 6.3)
- EPSS exploit prediction: 1% (43rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-1022
- Affected product: Texthelpers Project Texthelpers
- Published:
- Last modified:
Description
A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.
Frequently asked questions
- What is CVE-2020-36624?
- A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.
- How severe is CVE-2020-36624?
- CVE-2020-36624 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.
- Is CVE-2020-36624 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-36624?
- CVE-2020-36624 affects Texthelpers Project Texthelpers. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2020-36624?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2020-36624 published?
- CVE-2020-36624 was published on 2022-12-22 and last updated on 2026-06-17.
References
- https://github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3
- https://github.com/ahorner/text-helpers/pull/19
- https://github.com/ahorner/text-helpers/releases/tag/v1.1.0
- https://vuldb.com/?id.216520
Affected products (1)
- cpe:2.3:a:texthelpers_project:texthelpers:*:*:*:*:*:*:*:*
Other CWE-1022 vulnerabilities
- CVE-2022-1583 — Medium (CVSS 6.5): The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null"…
- CVE-2024-39727 — Medium (CVSS 6.1): IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted…
- CVE-2022-4927 — Medium (CVSS 5.5): A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some…
- CVE-2025-33014 — Medium (CVSS 5.4): IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a…
- CVE-2022-2600 — Medium (CVSS 5.4): The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which…
- CVE-2025-59842 — Medium (CVSS 4.3): jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…