CVE-2023-3978

2023-08-0705:49:01

redhat.com

access.redhat.com

golang html package

cross-site scripting

remote attacker

specially crafted url

script execution

victim's web browser

security context

cookie-based authentication credentials

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.9%

JSON

A flaw was found in the Golang HTML package where it is vulnerable to Cross-site scripting caused by the improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim’s web browser within the security context of the hosting website once the URL is clicked. The flaw allows an attacker to steal the victim’s cookie-based authentication credentials.