Vulnerability · Published Jul 25, 2023 · Assigned by GitHub_M
CVE-2023-38500By-passing Cross-Site Scripting Protection in HTML Sanitizer
Medium 4.7
In plain English
A medium-severity cross-site scripting in html-sanitizer from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | typo3/html-sanitizer | 1.5.1 | GHSA-59jf-3q9v-rh6g |
| Packagist | typo3/html-sanitizer | 2.1.2 | GHSA-59jf-3q9v-rh6g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | html-sanitizer | >= 1.0.0, < 1.5.1>= 2.0.0, < 2.1.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N