Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:46776
HistoryMay 07, 2024 - 7:40 a.m.

HTML Injection

2024-05-0707:40:30
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
html
injection
vulnerability
unicode
normalization
html sanitizer
software

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

html-sanitizer is vulnerable to HTML injection. The vulnerability is due to improper handling of unicode normalization, which results in certain unicode characters normalizing to chevrons (<, >) enabling specially crafted HTML to evade sanitization.

CPENameOperatorVersion
html-sanitizerle2.4.1
html-sanitizerle2.4.1

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%