Lucene search
Veracode Vulnerability DatabaseVERACODE:38466HistoryDec 14, 2022 - 4:47 a.m.
Cross-Site Scripting (XSS)
2022-12-1404:47:44
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
17
loofah
xss
vulnerability
data url
sanitization
software
remote attacker
javascript
0.001 Low
EPSS
Percentile
50.9%
loofah is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization data urls in the image/svg+xml parameter in safelist.rb which allows a remote attacker to inject and execute malicious JavaScript into the system.
References
github.com/advisories/GHSA-228g-948r-83gx
github.com/flavorjones/loofah/commit/415677f3cf7f9254f42f811e784985cd63c7407f
github.com/flavorjones/loofah/issues/101
github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx
github.com/w3c/svgwg/issues/266
hackerone.com/reports/1694173
lists.debian.org/debian-lts-announce/2023/09/msg00011.html
Related
prion
prion
Cross site scripting
2022-12-14 14:15:00
ubuntucve
ubuntucve
CVE-2022-23515
2022-12-14 00:00:00
hackerone
hackerone
redhatcve
redhatcve
CVE-2022-23515
2022-12-14 11:35:22
osv
osv
CVE-2022-23515
2022-12-14 14:15:10
Improper neutralization of data URIs may allow XSS in Loofah
2022-12-13 17:39:36
ruby-loofah - security update
2023-09-13 00:00:00
nvd
nvd
CVE-2022-23515
2022-12-14 14:15:10
github
github
Improper neutralization of data URIs may allow XSS in Loofah
2022-12-13 17:39:36
cve
cve
CVE-2022-23515
2022-12-14 14:15:10
debiancve
debiancve
CVE-2022-23515
2022-12-14 14:15:10
cvelist
cvelist
CVE-2022-23515 Improper neutralization of data URIs may allow XSS in Loofah
2022-12-14 13:23:02
nessus
nessus
Fedora 40 : rubygem-loofah (2023-1bbea3700b)
2024-04-29 00:00:00
Debian DLA-3565-1 : ruby-loofah - LTS security update
2023-09-14 00:00:00
debian
debian
[SECURITY] [DLA 3565-1] ruby-loofah security update
2023-09-13 15:09:07
openvas
openvas
Debian: Security Advisory (DLA-3565-1)
2023-09-14 00:00:00
rocky
rocky
Satellite 6.13 Release
2023-05-05 15:39:58
redhat
redhat
(RHSA-2023:2097) Important: Satellite 6.13 Release
2023-05-03 13:09:51