6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
36.1%
The html/template package does not properly handle HTML-like โโ comment
tokens, nor hashbang โ#!โ comment tokens, in <script> contexts. This may
cause the template parser to improperly interpret the contents of <script>
contexts, causing actions to be improperly escaped. This may be leveraged
to perform an XSS attack.
Author | Note |
---|---|
mdeslaur | Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | golang-1.10 | <ย any | UNKNOWN |
ubuntu | 14.04 | noarch | golang-1.10 | <ย any | UNKNOWN |
ubuntu | 16.04 | noarch | golang-1.10 | <ย any | UNKNOWN |
ubuntu | 18.04 | noarch | golang-1.13 | <ย any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.13 | <ย any | UNKNOWN |
ubuntu | 22.04 | noarch | golang-1.13 | <ย any | UNKNOWN |
ubuntu | 16.04 | noarch | golang-1.13 | <ย any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.14 | <ย any | UNKNOWN |
ubuntu | 18.04 | noarch | golang-1.16 | <ย any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.16 | <ย any | UNKNOWN |
github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c (go1.20.8)
github.com/golang/go/commit/b0e1d3ea26e8e8fce7726690c9ef0597e60739fb (go1.21.1)
go.dev/cl/526156
go.dev/issue/62196
groups.google.com/g/golang-announce/c/Fm51GRLNRvM
groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
launchpad.net/bugs/cve/CVE-2023-39318
nvd.nist.gov/vuln/detail/CVE-2023-39318
pkg.go.dev/vuln/GO-2023-2041
security-tracker.debian.org/tracker/CVE-2023-39318
ubuntu.com/security/notices/USN-6574-1
www.cve.org/CVERecord?id=CVE-2023-39318