PT-2018-5155

CVE-2017-0928

·

Published

2018-06-04

·

Updated

2019-10-09

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions html-janitor versions prior to 2.0.4
Description The issue allows for the bypass of sanitization due to user control of the sanitized variable, leading to cross-site scripting (XSS) attacks. This can occur when arbitrary HTML passes the sanitization process, posing a risk if user-controlled input is passed to the clean function.
Recommendations Upgrade to version 2.0.4 or later.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-547: Use of Hard-coded, Security-relevant Constants
CWE-642: External Control of Critical State Data
Related identifiers
CVE-2017-0928
GHSA-FX46-WHRJ-73V5
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com