CVE-2021-42576

Опубликовано: 18 окт. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Ссылки

https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
Exploit
Third Party Advisory
https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:microco:bluemonday:*:*:*:*:*:go:*:*

Версия до 1.0.16 (исключая)

Конфигурация 2

cpe:2.3:a:python:pybluemonday:*:*:*:*:*:*:*:*

Версия до 0.0.8 (исключая)

EPSS

Процентиль: 55%

0.00321

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2021-42576

CVSS3: 9.8

ubuntu

больше 4 лет назад

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

CVE-2021-42576

CVSS3: 9.8

debian

больше 4 лет назад

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Py ...

GHSA-x95h-979x-cf3j

CVSS3: 9.8

github

больше 4 лет назад

Policies not properly enforced in bluemonday

EPSS

Процентиль: 55%

0.00321

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

NVD-CWE-Other