GHSA-59jf-3q9v-rh6g
Suggest an improvement- Source
- https://github.com/advisories/GHSA-59jf-3q9v-rh6g
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-59jf-3q9v-rh6g/GHSA-59jf-3q9v-rh6g.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-59jf-3q9v-rh6g
- Aliases
- Published
- 2023-07-25T18:27:16Z
- Modified
- 2024-02-16T08:25:05.703021Z
- Severity
-
- 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- By-passing Cross-Site Scripting Protection in HTML Sanitizer
- Details
-
CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(4.4)Problem
Due to an encoding issue in the serialization layer, malicious markup nested in a
noscriptelement was not encoded correctly.noscriptis disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism oftypo3/html-sanitizer.Solution
Update to
typo3/html-sanitizerversions 1.5.1 or 2.1.2 that fix the problem described.Credits
Thanks to David Klein and Yaniv Nizry who reported this issue, and to TYPO3 security team members Oliver Hader and Benjamin Franzke who fixed the issue.
References
- Database specific
{ "nvd_published_at": "2023-07-25T21:15:11Z", "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-07-25T18:27:16Z" }- References
-
- https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g
- https://nvd.nist.gov/vuln/detail/CVE-2023-38500
- https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb
- https://github.com/TYPO3/html-sanitizer
- https://typo3.org/security/advisory/typo3-core-sa-2023-002
Affected packages
Packagist / typo3/html-sanitizer
Package
- Name
- typo3/html-sanitizer
- Purl
- pkg:composer/typo3/html-sanitizer
Packagist / typo3/html-sanitizer
Package
- Name
- typo3/html-sanitizer
- Purl
- pkg:composer/typo3/html-sanitizer