Bleach URI Scheme Restriction Bypass
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-7753US | critical9.8 | — | ||
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entitie… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://bugs.debian.org/892252WEB
- https://github.com/mozilla/bleachPACKAGE
- https://github.com/mozilla/bleach/commit/c5df5789ec3471a31311f42c2d19fc2cf21b35efWEB
- https://github.com/mozilla/bleach/releases/tag/v2.1.3WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2018-51.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-7753ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan