Lucene search

Veracode Vulnerability DatabaseVERACODE:45614

HistoryFeb 23, 2024 - 8:14 a.m.

Cross Site Scripting (XSS)

2024-02-2308:14:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site scripting

mjml

input validation

html entities

software

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

JSON

mjml is vulnerable to Cross Site Scripting (XSS). The vulnerability is due to improper input validation for HTML entities. This allows an attacker to insert untrusted data into MJML templates, which can result in Cross Site Scripting (XSS).

CPENameOperatorVersion
mjmlle0.10.0
mjmlle0.10.0

CPE	Name	Operator	Version
	mjml	le	0.10.0
	mjml	le	0.10.0

References

github.com/FelixSchwarz/mjml-python/commit/84c495da20a91640a1ca551ace17df7f3be644aa

github.com/FelixSchwarz/mjml-python/commit/8d410b7a500703080bb14ed7e3d2663fe16767e6

github.com/FelixSchwarz/mjml-python/issues/52

github.com/FelixSchwarz/mjml-python/releases/tag/v0.11.0

github.com/FelixSchwarz/mjml-python/security/advisories/GHSA-578p-fxmm-6229