Описание
BaseCookie.js_output() does not neutralize embedded characters
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| azl3 python3 3.12.14-1 on Azure Linux 3.0 | ||
| cbl2 python3 3.9.19-19 on CBL-Mariner 2.0 | - | |
| azl3 python3 3.12.14-2 on Azure Linux 3.0 | - | |
| azl3 python3 3.12.16-1 on Azure Linux 3.0 | - |
Показывать по
EPSS
Связанные уязвимости
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
http.cookies.Morsel.js_output() returns an inline <script> snippet and ...
EPSS