PT-2020-12921
CVE-2020-11888
·
Published
2020-04-20
·
Updated
2020-05-25
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
python-markdown2 versions 2.3.8 and earlier
Description
The issue arises from the mishandling of element names, which can lead to XSS attacks unless a w+ match succeeds. An example of a potential attack involves using element names with special characters, such as
elementname@ or elementname-, in combination with an onclick attribute.Recommendations
For python-markdown2 versions 2.3.8 and earlier, update to a version that properly handles element names to prevent XSS attacks.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾