6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
58.5%
A mutation XSS affects users calling bleach.clean
with all of:
svg
or math
in the allowed/whitelisted tagsstrip=False
Users are encouraged to upgrade to bleach v3.1.2 or greater.
bleach.clean
calls to use strip=True
, or not whitelist math
or svg
tags and one or more of the following tags:script
noscript
style
noframes
xmp
noembed
iframe
unsafe-inline
and unsafe-eval
script-src
s) will also help mitigate the risk.If you have any questions or comments about this advisory:
advisory.checkmarx.net/advisory/CX-2020-4277
github.com/advisories/GHSA-m6xf-fq7q-8743
github.com/mozilla/bleach/releases/tag/v3.1.2
github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
lists.fedoraproject.org/archives/list/[email protected]/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/
nvd.nist.gov/vuln/detail/CVE-2020-6816
www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
58.5%