Описание
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| python-markdown2 | fixed | 2.3.9-1 | package | |
| python-markdown2 | fixed | 2.3.7-2+deb10u1 | buster | package |
Примечания
https://github.com/trentm/python-markdown2/issues/348
EPSS
Процентиль: 70%
0.0065
Низкий
Связанные уязвимости
CVSS3: 6.1
ubuntu
почти 6 лет назад
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
CVSS3: 6.1
nvd
почти 6 лет назад
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
EPSS
Процентиль: 70%
0.0065
Низкий