GHSA-pgww-xf46-h92r
Vulnerability from github
Published
2021-01-07 21:54
Modified
2023-09-05 14:36
Severity
Summary
lxml vulnerable to Cross-site Scripting
Details
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lxml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-27783"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2021-01-07T21:53:43Z",
"nvd_published_at": "2020-12-03T17:15:00Z",
"severity": "MODERATE"
},
"details": "A XSS vulnerability was discovered in python-lxml\u0027s clean module. The module\u0027s parser didn\u0027t properly imitate browsers, which caused different behaviors between the sanitizer and the user\u0027s page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.",
"id": "GHSA-pgww-xf46-h92r",
"modified": "2023-09-05T14:36:43Z",
"published": "2021-01-07T21:54:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27783"
},
{
"type": "WEB",
"url": "https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7"
},
{
"type": "WEB",
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4286"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901633"
},
{
"type": "WEB",
"url": "https://github.com/lxml/lxml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK"
},
{
"type": "WEB",
"url": "https://pypi.org/project/lxml"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210521-0003"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-LXML-1047473"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4810"
},
{
"type": "WEB",
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "lxml vulnerable to Cross-site Scripting"
}
Loading...