---
cve: "CVE-2020-36190"
severity: "LOW"
cvss: 3.1
epss: "1.3%"
vendor: "n/a"
kev: false
exploited: false
published: "2021-01-12 19:38:20"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-10T10:58:09+02:00"
---

# CVE-2020-36190

> 3.1 LOW · 🧪 PoC

## Beschreibung

RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.

## Patch verfügbar (OSV)

- 3b505fc8d81ede2e15cfd071fc7639f8309a6866 (Commit)
- 7a268dad1b1cd26c09eba9d850aad56529ed821c (Commit)

## Referenzen

- <https://github.com/sferik/rails_admin/blob/master/README.md>
- <https://github.com/sferik/rails_admin/commit/d72090ec6a07c3b9b7b48ab50f3d405f91ff4375>
- <https://github.com/sferik/rails_admin/compare/v1.4.2...v1.4.3>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2020-36190) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_