BIT-golang-2023-24540

vendorUSosv

Improper handling of JavaScript whitespace in html/template

view advisory published 2024-03-06Licence: per source

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-24540US	critical9.8	1.56% (75th)	—	2023-05-11
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029"…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/491616FIX
https://go.dev/issue/59721FIX
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsUDISCUSSION
https://nvd.nist.gov/vuln/detail/CVE-2023-24540WEB
https://pkg.go.dev/vuln/GO-2023-1752ADVISORY
https://security.netapp.com/advisory/ntap-20241115-0008/WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan