PT-2023-8924

CVE-2023-36823

تاريخ النشر

2023-07-06

تاريخ التحديث

2024-04-24

الوصف من

CVSS 2.0

7.5

عالية

المقاييسAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sanitize versions 3.0.0 through 6.0.2

Description The issue is related to the Sanitize HTML and CSS sanitizer, which can be exploited by an attacker using carefully crafted input to sneak arbitrary HTML and CSS through the sanitizer. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. The exploitation is possible when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows style elements and one or more CSS at-rules.

Recommendations For Sanitize versions 3.0.0 through 6.0.2, consider the following:

Upgrade to Sanitize version 6.0.2 or later, which performs additional escaping of CSS in style element content.
Use a Sanitize config that doesn't allow style elements.
Use a Sanitize config that doesn't allow CSS at-rules.
Manually escape the character sequence </ as </ in style element content.

قابلية الاستغلال

استغلال

إصلاح

التأثيرات

الباحثون

Cure53

المورّدون

المنتجات المتأثرة

تصنيف نقاط الضعف

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

المعرّفات ذات الصلة

CVE-2023-36823