Описание
URLs in meta content attribute actions are not escaped in html/template
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| azl3 golang 1.27.0-1 on Azure Linux 3.0 | ||
| cbl2 golang 1.22.7-5 on CBL-Mariner 2.0 | - | |
| cbl2 msft-golang 1.25.8-1 on CBL-Mariner 2.0 | - |
Показывать по
EPSS
7.5 High
CVSS3
Связанные уязвимости
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Actions which insert URLs into the content attribute of HTML meta tags ...
EPSS
7.5 High
CVSS3