Lucene search

K
osvGoogleOSV:GO-2023-2043
HistorySep 07, 2023 - 4:11 p.m.

Improper handling of special tags within script contexts in html/template

2023-09-0716:11:59
Google
osv.dev
25
html/template
special tags
script contexts
xss attack

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.4%

The html/template package does not apply the proper rules for handling occurrences of โ€œ<scriptโ€, "

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.4%