Lucene search

K
cveGoCVE-2023-3978
HistoryAug 02, 2023 - 8:15 p.m.

CVE-2023-3978

2023-08-0220:15:12
CWE-79
Go
web.nvd.nist.gov
195
cve
2023
3978
nvd
security
xss
attack
html
namespace

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

34.9%

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Affected configurations

Nvd
Node
golangnetworkingRange<0.13.0go
VendorProductVersionCPE
golangnetworking*cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:*

CNA Affected

[
  {
    "vendor": "golang.org/x/net",
    "product": "golang.org/x/net/html",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "golang.org/x/net/html",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.13.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "render1"
      },
      {
        "name": "Render"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

34.9%