Sanitize vulnerabilities

2024-04-2400:00:00

ubuntu.com

ubuntu 23.10

ubuntu 22.04 lts

ubuntu 20.04 lts

ruby-sanitize

html sanitizer

css sanitizer

cross-site scripting

cve-2023-23627

cve-2023-36823

unix

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

Releases

Ubuntu 23.10
Ubuntu 22.04 LTS
Ubuntu 20.04 LTS

Packages

ruby-sanitize - Allowlist-based HTML and CSS sanitizer

Details

It was discovered that Sanitize incorrectly handled noscript elements
under certain circumstances. An attacker could possibly use this issue to
execute a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 22.04 LTS. (CVE-2023-23627)

It was discovered that Sanitize incorrectly handled style elements under
certain circumstances. An attacker could possibly use this issue to
execute a cross-site scripting (XSS) attack. (CVE-2023-36823)

OSVersionArchitecturePackageVersionFilename
Ubuntu23.10noarchruby-sanitize< 6.0.0-1.1ubuntu0.23.10.1UNKNOWN
Ubuntu22.04noarchruby-sanitize< 6.0.0-1ubuntu0.1UNKNOWN
Ubuntu20.04noarchruby-sanitize< 4.6.6-2.1~0.20.04.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	23.10	noarch	ruby-sanitize	< 6.0.0-1.1ubuntu0.23.10.1	UNKNOWN
Ubuntu	22.04	noarch	ruby-sanitize	< 6.0.0-1ubuntu0.1	UNKNOWN
Ubuntu	20.04	noarch	ruby-sanitize	< 4.6.6-2.1~0.20.04.2	UNKNOWN