Sanitize vulnerable to Improper Input Validation and Cross-site Scripting
When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-3740US | high7.5 | — | ||
A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-releasedWEB
- https://github.com/rgrove/sanitizePACKAGE
- https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46eWEB
- https://github.com/rgrove/sanitize/commit/93feeb38e21864146bb29191792b971dbe1ec62eWEB
- https://github.com/rgrove/sanitize/issues/176WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sanitize/CVE-2018-3740.ymlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-3740ADVISORY
- https://www.debian.org/security/2018/dsa-4358WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan