GitHub Advisoryadvisory · Packagist

GHSA-59jf-3q9v-rh6g By-passing Cross-Site Scripting Protection in HTML Sanitizer

MEDIUM Published 2023-07-25 Modified 2023-07-25 Official page ↗
Aliases
CVE-2023-38500
Ecosystem
Packagist
Packages
typo3/html-sanitizer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-25

Affected packages

• Packagist typo3/html-sanitizer: >= 1.0.0, < 1.5.1 → fixed in 1.5.1 • Packagist typo3/html-sanitizer: >= 2.0.0, < 2.1.2 → fixed in 2.1.2

Description

> ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.4) Problem Due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of `typo3/html-sanitizer`. Solution Update to `typo3/html-sanitizer` versions 1.5.1 or 2.1.2 that fix the problem described. Credits Thanks to David Klein and Yaniv Nizry who reported this issue, and to TYPO3 security team members Oliver Hader and Benjamin Franzke who fixed the issue. References • TYPO3-CORE-SA-2023-002

Related

Alias · CVE (1)

  • CVE-2023-38500 TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References