Описание
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
A flaw was found in the html/template component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.
Отчет
This is an Important cross-site scripting (XSS) vulnerability in the Go html/template package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-rhel9 | Affected | ||
| AWS Load Balancer Operator | albo/aws-load-balancer-controller-rhel8 | Affected | ||
| Compliance Operator | compliance/openshift-compliance-rhel8-operator | Affected | ||
| Confidential Compute Attestation | build-of-trustee/trustee-rhel9-operator | Affected | ||
| Deployment Validation Operator | dvo/deployment-validation-rhel8-operator | Affected | ||
| Exploit Intelligence | exploit-intelligence-tech-preview/agent-client-rhel9 | Affected | ||
| Exploit Intelligence | exploit-intelligence-tech-preview/exploit-intelligence-operator-controller-rhel9 | Affected | ||
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Affected | ||
| ExternalDNS Operator | edo/external-dns-rhel9 | Affected | ||
| ExternalDNS Operator | edo/external-dns-rhel9-operator | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Previously, pathological inputs could close an unescaped '/' early, al ...
EPSS
8.1 High
CVSS3