CVE-2023-24539

2023-05-1100:00:00

ubuntu.com

cve-2023-24539

css context

injection risk

multiple actions

unexpected closure

untrusted input

unix

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.001

Percentile

49.7%

JSON

Angle brackets (<>) are not considered dangerous characters when inserted
into CSS contexts. Templates containing multiple actions separated by a ‘/’
character can result in unexpectedly closing the CSS context and allowing
for injection of unexpected HTML, if executed with untrusted input.

OSVersionArchitecturePackageVersionFilename
ubuntu22.10noarchgolang-1.19< 1.19.2-1ubuntu1.1UNKNOWN
ubuntu23.04noarchgolang-1.19< 1.19.8-1ubuntu0.1UNKNOWN
ubuntu23.04noarchgolang-1.20< 1.20.3-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.10	noarch	golang-1.19	< 1.19.2-1ubuntu1.1	UNKNOWN
ubuntu	23.04	noarch	golang-1.19	< 1.19.8-1ubuntu0.1	UNKNOWN
ubuntu	23.04	noarch	golang-1.20	< 1.20.3-1ubuntu0.1	UNKNOWN