Lucene search

[email protected]NVD:CVE-2014-3146

HistoryMay 14, 2014 - 7:55 p.m.

CVE-2014-3146

2014-05-1419:55:11

[email protected]

web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6 Medium

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

86.0%

JSON

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

Affected configurations

NVD

Node

lxmllxmlRange≤3.3.4

lxmllxmlMatch0.5

lxmllxmlMatch0.5.1

lxmllxmlMatch0.6

lxmllxmlMatch0.7

lxmllxmlMatch0.8

lxmllxmlMatch0.9

lxmllxmlMatch0.9.1

lxmllxmlMatch0.9.2

lxmllxmlMatch1.0

lxmllxmlMatch1.0.1

lxmllxmlMatch1.0.2

lxmllxmlMatch1.0.3

lxmllxmlMatch1.0.4

lxmllxmlMatch1.1

lxmllxmlMatch1.1.1

lxmllxmlMatch1.1.2

lxmllxmlMatch1.2

lxmllxmlMatch1.2.1

lxmllxmlMatch1.3

lxmllxmlMatch1.3.1

lxmllxmlMatch1.3.2

lxmllxmlMatch1.3.3

lxmllxmlMatch1.3.4

lxmllxmlMatch1.3.5

lxmllxmlMatch1.3.6

lxmllxmlMatch2.0

lxmllxmlMatch2.0.1

lxmllxmlMatch2.0.2

lxmllxmlMatch2.0.3

lxmllxmlMatch2.0.4

lxmllxmlMatch2.0.5

lxmllxmlMatch2.0.6

lxmllxmlMatch2.0.7

lxmllxmlMatch2.0.8

lxmllxmlMatch2.0.9

lxmllxmlMatch2.0.10

lxmllxmlMatch2.0.11

lxmllxmlMatch2.1alpha1

lxmllxmlMatch2.1beta1

lxmllxmlMatch2.1beta2

lxmllxmlMatch2.1beta3

lxmllxmlMatch2.1.1

lxmllxmlMatch2.1.2

lxmllxmlMatch2.1.3

lxmllxmlMatch2.1.4

lxmllxmlMatch2.2-

lxmllxmlMatch2.2alpha1

lxmllxmlMatch2.2beta1

lxmllxmlMatch2.2beta2

lxmllxmlMatch2.2beta3

lxmllxmlMatch2.2beta4

lxmllxmlMatch2.2.1

lxmllxmlMatch2.2.2

lxmllxmlMatch2.2.3

lxmllxmlMatch2.2.4

lxmllxmlMatch2.2.5

lxmllxmlMatch2.2.6

lxmllxmlMatch2.2.7

lxmllxmlMatch2.2.8

lxmllxmlMatch2.3-

lxmllxmlMatch2.3alpha1

lxmllxmlMatch2.3alpha2

lxmllxmlMatch2.3beta1

lxmllxmlMatch2.3.1

lxmllxmlMatch2.3.2

lxmllxmlMatch2.3.3

lxmllxmlMatch2.3.4

lxmllxmlMatch2.3.5

lxmllxmlMatch2.3.6

lxmllxmlMatch3.0-

lxmllxmlMatch3.0alpha1

lxmllxmlMatch3.0alpha2

lxmllxmlMatch3.0beta1

lxmllxmlMatch3.0.1

lxmllxmlMatch3.0.2

lxmllxmlMatch3.1beta1

lxmllxmlMatch3.1.0

lxmllxmlMatch3.1.1

lxmllxmlMatch3.1.2

lxmllxmlMatch3.2.0

lxmllxmlMatch3.2.1

lxmllxmlMatch3.2.2

lxmllxmlMatch3.2.3

lxmllxmlMatch3.2.4

lxmllxmlMatch3.2.5

lxmllxmlMatch3.3.0-

lxmllxmlMatch3.3.0beta1

lxmllxmlMatch3.3.0beta2

lxmllxmlMatch3.3.0beta3

lxmllxmlMatch3.3.0beta4

lxmllxmlMatch3.3.0beta5

lxmllxmlMatch3.3.1

lxmllxmlMatch3.3.2

lxmllxmlMatch3.3.3

References

advisories.mageia.org/MGASA-2014-0218.html

lists.opensuse.org/opensuse-updates/2014-05/msg00083.html

lxml.de/3.3/changes-3.3.5.html

seclists.org/fulldisclosure/2014/Apr/210

seclists.org/fulldisclosure/2014/Apr/319

secunia.com/advisories/58013

secunia.com/advisories/58744

secunia.com/advisories/59008

www.debian.org/security/2014/dsa-2941

www.mandriva.com/security/advisories?name=MDVSA-2015:112

www.openwall.com/lists/oss-security/2014/05/09/7

www.securityfocus.com/bid/67159

www.ubuntu.com/usn/USN-2217-1

mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6 Medium

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

86.0%

JSON

Related for NVD:CVE-2014-3146

nessus25 openvas17 osv7 prion2 debiancve2 cvelist2 debian4 ubuntucve2 mageia1 github2 ubuntu1 cve2 redhatcve1 nvd1 securityvulns1 ibm1