GitHub Advisoryadvisory · Packagist

GHSA-3p68-m5qw-9g9w HTML Purifier cross-site scripting (XSS) vulnerability

MEDIUM Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2010-4183
Ecosystem
Packagist
Packages
ezyang/htmlpurifier
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-04-23

Affected packages

• Packagist ezyang/htmlpurifier: < 4.1.0 → fixed in 4.1.0

Description

Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.

Related

Alias · CVE (1)

  • CVE-2010-4183 Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References