Improper handling of special tags within script contexts in html/template
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-39319US | medium6.1 | — | ||
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the… | ||||
02
references
External citations — patches, advisories, analysis.
- https://go.dev/cl/526157FIX
- https://go.dev/issue/62197REPORT
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJARTICLE
- https://nvd.nist.gov/vuln/detail/CVE-2023-39319WEB
- https://pkg.go.dev/vuln/GO-2023-2043ADVISORY
- https://security.gentoo.org/glsa/202311-09WEB
- https://security.netapp.com/advisory/ntap-20231020-0009/ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan