CVE-2023-24539

🗓️ 11 May 2023 15:29:38Reported by GoType

Angle brackets not dangerous in CSS, template actions with slash can close CSS contex

Reporter	Title	Published	Views	Family All 322
IBM Security Bulletins	Security Bulletin: Vulnerabilities in GoLang Go and Kubernetes affect IBM watsonx.data	18 Sep 202416:17	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to Go [CVE-2023-24539 and CVE-2023-24540]	29 Jun 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from systemd, libcap, openssl-libs, libxml2, go-toolset, and prometheus-operator	28 Aug 202308:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities	4 Sep 202311:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Golang Go affect Cloud Pak System	2 Jan 202411:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by multiple vulnerabilities in Golang Go	26 Jul 202320:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to html injection due to [CVE-2023-24539]	28 Jun 202315:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to multiple ansible-operator vulnerabilities	20 Feb 202419:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by multiple Golang Go vulnerabilities	25 Jul 202306:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is susceptible to numerous vulnerabilities due to Golang Go (CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405, CVE-2023-29406, CVE-2023-29400, CVE-2023-24540, CVE-2023-24539, X-Force 250518)	25 Sep 202317:11	–	ibm

NVD

Node

golang goRange<1.19.9

golang goRange1.20.0–1.20.4

[
  {
    "vendor": "Go standard library",
    "product": "html/template",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "html/template",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.19.9",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.20.0-0",
        "lessThan": "1.20.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "cssValueFilter"
      },
      {
        "name": "escaper.commit"
      },
      {
        "name": "Template.Execute"
      },
      {
        "name": "Template.ExecuteTemplate"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
go	www.go.dev/issue/59720
pkg	www.pkg.go.dev/vuln/GO-2023-1751
go	www.go.dev/cl/491615
groups	www.groups.google.com/g/golang-announce/c/MEb0UyuSMsU
security	www.security.netapp.com/advisory/ntap-20241129-0005/

24 Jan 2025 17:15Current

8.6High risk

Vulners AI Score8.6

CVSS 3.17.3

EPSS0.00077

SSVC