CVE-2023-24539

Improper sanitization of CSS values in html/template

Published May 11, 2023 CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed
Description
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-28555 Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.
Ubuntu USN Ubuntu USN USN-6140-1 Go vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00065}

epss

{'score': 0.00067}

Type Values Removed Values Added
Weaknesses CWE-94
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}