CVE-2024-23341 TuiTse-TsuSin html injection vulnerability in `tuitse_html` function

2024-01-2317:22:39

CWE-79

GitHub_M

www.cve.org

tuitse-tsusin

html injection

vulnerability

taiwanese chinese

roman characters

input sanitization

patch

cve-2024-23341

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

20.6%

JSON

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using tuitse_html without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.

CNA Affected

[
  {
    "vendor": "i3thuan5",
    "product": "TuiTse-TsuSin",
    "versions": [
      {
        "version": "< 1.3.2",
        "status": "affected"
      }
    ]
  }
]