CVE-2020-27783

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-27783
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-27783.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-27783
Aliases
Downstream
ALPINE (1)
ALSA (2)
AZL (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (4)
RLSA (3)
SUSE (8)
UBUNTU (1)
Related
ALSA (2)
openSUSE (2)
SUSE (8)
Published
2020-12-03T17:15:13Z
Modified
2026-10-24T10:30:30Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "9.0"
                        },
                        {
                            "last_affected": "9.0"
                        },
                        {
                            "introduced": "10.0"
                        },
                        {
                            "last_affected": "10.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "32"
                        },
                        {
                            "last_affected": "32"
                        },
                        {
                            "introduced": "33"
                        },
                        {
                            "last_affected": "33"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "fedoraproject:fedora"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "12.0.0.3.0"
                        },
                        {
                            "last_affected": "12.0.0.3.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "oracle:communications_offline_mediation_controller"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.8"
                        },
                        {
                            "last_affected": "8.8"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "oracle:zfs_storage_appliance_kit"
        },
        {
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.0"
                        },
                        {
                            "last_affected": "8.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "redhat:enterprise_linux"
        }
    ]
}
References

Affected packages

Git / github.com/lxml/lxml

Affected ranges

Type
GIT
Repo
https://github.com/lxml/lxml
Events
Introduced
2940d9b6723599da95cf294fe5125e29c9751f7b
Fixed
4cb57362deb23bca0f70f41ab1efa13390fcdbb1
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.2"
                },
                {
                    "fixed": "4.6.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

lxml-1.*
lxml-1.2
lxml-2.*
lxml-2.0
lxml-2.0.1
lxml-2.0alpha1
lxml-2.0alpha2
lxml-2.0alpha3
lxml-2.0alpha4
lxml-2.0alpha5
lxml-2.0alpha6
lxml-2.0beta1
lxml-2.0beta2
lxml-2.1
lxml-2.1alpha1
lxml-2.1beta1
lxml-2.1beta2
lxml-2.1beta3
lxml-2.2
lxml-2.2.1
lxml-2.2.2
lxml-2.3
lxml-2.3.1
lxml-2.3alpha1
lxml-2.3alpha2
lxml-2.3beta1
lxml-3.*
lxml-3.0
lxml-3.0.1
lxml-3.0alpha1
lxml-3.0alpha2
lxml-3.0beta1
lxml-3.1.0
lxml-3.1.1
lxml-3.1beta1
lxml-3.2.0
lxml-3.2.1
lxml-3.2.2
lxml-3.2.3
lxml-3.3.0
lxml-3.3.0beta1
lxml-3.3.0beta2
lxml-3.3.0beta3
lxml-3.3.0beta4
lxml-3.3.0beta5
lxml-3.3.1
lxml-3.3.2
lxml-3.3.3
lxml-3.4.0
lxml-3.4.0beta1
lxml-3.4.1
lxml-3.5.0
lxml-3.5.0b1
lxml-3.6.0
lxml-3.6.1
lxml-3.7.0
lxml-3.7.1
lxml-3.7.2
lxml-3.8.0
lxml-3.8.0-py27fix
lxml-4.*
lxml-4.0.0
lxml-4.1.0
lxml-4.1.1
lxml-4.2.0
lxml-4.2.1
lxml-4.2.2
lxml-4.3.0
lxml-4.3.1
lxml-4.3.2
lxml-4.4.0
lxml-4.4.1
lxml-4.5.0
lxml-4.5.1
lxml-4.5.2
lxml-4.6.0
lxml-4.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-27783.json"