CVE-2024-52595 Vulnerability Details
/
/
/
CVE-2024-52595 Metadata Quick Info
CVE Published: 19/11/2024 |
CVE Updated: 20/11/2024 |
CVE Year: 2024
Source: GitHub_M |
Vendor: fedora-python |
Product: lxml_html_clean
Status : PUBLISHED
CVE-2024-52595 Description
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `
`, `` and ``. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove - their content is moved to their parents\' tags. Via `kill_tags`, one may specify tags to be removed completely. Via `allow_tags`, one may restrict the set of permissible tags, excluding context-switching tags like ``, `` and ``. Metrics
CVSS Version: 3.1 |
Base Score: 7.7 HIGH Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H l➤ Exploitability Metrics: Attack Vector (AV)* NETWORK Attack Complexity (AC)* HIGH Privileges Required (PR)* NONE User Interaction (UI)* NONE Scope (S)* UNCHANGED l➤ Impact Metrics: Confidentiality Impact (C)* HIGH Integrity Impact (I)* LOW Availability Impact (A)* HIGH Weakness Enumeration (CWE)
CWE-ID: CWE-79 CWE Name: CWE-79: Improper Neutralization of Input During Web Page Generation (
Cross-site Scripting
) Source: fedora-python Common Attack Pattern Enumeration and Classification (CAPEC)
CAPEC-ID: CAPEC Description:
Source: NVD (National Vulnerability Database).