6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
31.5%
A mutation XSS affects users calling bleach.clean
with all of:
svg
or math
in the allowed tagsp
or br
in allowed tagsstyle
, title
, noscript
, script
, textarea
, noframes
, iframe
, or xmp
in allowed tagsstrip_comments=False
Note: none of the above tags are in the default allowed tags and strip_comments
defaults to True
.
Users are encouraged to upgrade to bleach v3.3.0 or greater.
Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.
modify bleach.clean
calls to at least one of:
style
, title
, noscript
, script
, textarea
, noframes
, iframe
, or xmp
tagsvg
or math
tagsp
or br
tagsstrip_comments=True
A strong Content-Security-Policy without unsafe-inline
and unsafe-eval
script-src
s) will also help mitigate the risk.
If you have any questions or comments about this advisory:
bugzilla.mozilla.org/show_bug.cgi?id=1689399
bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-23980
cure53.de/fp170.pdf
github.com/advisories/GHSA-vv2x-vrpj-qqpq
github.com/mozilla/bleach/blob/79b7a3c5e56a09d1d323a5006afa59b56162eb13/CHANGES#L4
github.com/mozilla/bleach/commit/79b7a3c5e56a09d1d323a5006afa59b56162eb13
github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq
nvd.nist.gov/vuln/detail/CVE-2021-23980
pypi.org/project/bleach/
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
31.5%