CVE-2022-23499

2022-12-1321:15:11

CWE-79

[email protected]

web.nvd.nist.gov

html sanitizer

php

cve-2022-23499

parsing issue

xss

bypass

security vulnerability

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.5%

JSON

HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (script, style, noframes, noembed and iframe) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that’s why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. This issue has been fixed in versions 1.5.0 and 2.1.1.

Affected configurations

Vulners

NVD

Node

typo3html_sanitizerRange1.0.0–1.5.0

typo3html_sanitizerRange2.0.0–2.1.1

VendorProductVersionCPE
typo3html_sanitizer*cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*
typo3html_sanitizer*cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
typo3	html_sanitizer	*	cpe:2.3:a:typo3:html_sanitizer::::::::
typo3	html_sanitizer	*	cpe:2.3:a:typo3:html_sanitizer::::::::

CNA Affected

[
  {
    "vendor": "TYPO3",
    "product": "html-sanitizer",
    "versions": [
      {
        "version": ">= 1.0.0, < 1.5.0",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.1.1",
        "status": "affected"
      }
    ]
  }
]