CVE-2020-6802
published 2020-03-24CVE-2020-6802: In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.69%
74.4th percentile
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-bleach | < python-bleach 3.1.1-1 (bookworm) | python-bleach 3.1.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mozilla | bleach | < 3.1.1 | 3.1.1 |
| mozilla | bleach | >= 0 < 3.1.1 | 3.1.1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa6.1MEDIUM
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-bleach vulnerabilities
osv·2026-03-05·CVSS 9.8
CVE-2018-7753 [CRITICAL] python-bleach vulnerabilities
python-bleach vulnerabilities
It was discovered that Bleach did not properly sanitize URI attributes
containing character entities. An attacker could possibly use this issue
to construct a URI with a disallowed scheme that would bypass
sanitization, leading to cross-site scripting. This issue only affected
Ubuntu 18.04 LTS. (CVE-2018-7753)
Yaniv Nizry discovered that Bleach was vulnerable to a mutation
cross-site scripting issue when sanitizing HTML with the noscript tag
and a raw tag in the allowed tags list. An attacker could possibly
use this issue to inject malicious content, leading to cross-site
scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-6802)
Yaniv Nizry discovered that Bleach was vulnerable to a mutation
cross-site scripting issue when sanitizing HTML with R
OSV
CVE-2020-6802: In Mozilla Bleach before 3
osv·2020-03-24·CVSS 6.1
CVE-2020-6802 [MEDIUM] CVE-2020-6802: In Mozilla Bleach before 3
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
OSV
XSS in Bleach when noscript and raw tag whitelisted
osv·2020-02-24·CVSS 6.1
CVE-2020-6802 [MEDIUM] XSS in Bleach when noscript and raw tag whitelisted
XSS in Bleach when noscript and raw tag whitelisted
### Impact
A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with `noscript` and a raw tag (see below) in the allowed/whitelisted tags option.
### Patches
v3.1.1
### Workarounds
* modify `bleach.clean` calls to not whitelist `noscript` and one or more of the following raw tags:
```
title
textarea
script
style
noembed
noframes
iframe
xmp
```
* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.
### References
* https://bugzilla.mozilla.org/show_bug.cgi?id=1615315
* https://cur
GHSA
XSS in Bleach when noscript and raw tag whitelisted
ghsa·2020-02-24·CVSS 6.1
CVE-2020-6802 [MEDIUM] CWE-79 XSS in Bleach when noscript and raw tag whitelisted
XSS in Bleach when noscript and raw tag whitelisted
### Impact
A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with `noscript` and a raw tag (see below) in the allowed/whitelisted tags option.
### Patches
v3.1.1
### Workarounds
* modify `bleach.clean` calls to not whitelist `noscript` and one or more of the following raw tags:
```
title
textarea
script
style
noembed
noframes
iframe
xmp
```
* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.
### References
* https://bugzilla.mozilla.org/show_bug.cgi?id=1615315
* https://cur
Ubuntu
Bleach vulnerabilities
vendor_ubuntu·2026-03-05·CVSS 9.8
CVE-2018-7753 [CRITICAL] Bleach vulnerabilities
Title: Bleach vulnerabilities
Summary: Several security issues were fixed in Bleach.
It was discovered that Bleach did not properly sanitize URI attributes
containing character entities. An attacker could possibly use this issue
to construct a URI with a disallowed scheme that would bypass
sanitization, leading to cross-site scripting. This issue only affected
Ubuntu 18.04 LTS. (CVE-2018-7753)
Yaniv Nizry discovered that Bleach was vulnerable to a mutation
cross-site scripting issue when sanitizing HTML with the noscript tag
and a raw tag in the allowed tags list. An attacker could possibly
use this issue to inject malicious content, leading to cross-site
scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-6802)
Yaniv Nizry discovered that Bleach was vulnerable to a mutatio
Debian
CVE-2020-6802: python-bleach - In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean...
vendor_debian·2020·CVSS 6.1
CVE-2020-6802 [MEDIUM] CVE-2020-6802: python-bleach - In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean...
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
Scope: local
bookworm: resolved (fixed in 3.1.1-1)
bullseye: resolved (fixed in 3.1.1-1)
forky: resolved (fixed in 3.1.1-1)
sid: resolved (fixed in 3.1.1-1)
trixie: resolved (fixed in 3.1.1-1)
Suricata
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6802 [HIGH] ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID SELECT
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID SELECT"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; classtype:web-application-attack; sid:2006153; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial
Suricata
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6802 [HIGH] ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UNION SELECT
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UNION SELECT"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; classtype:web-application-attack; sid:2006154; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic
Suricata
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2006-6802 [HIGH] ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UPDATE
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UPDATE"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; classtype:web-application-attack; sid:2006158; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_
Suricata
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2006-6802 [HIGH] ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID DELETE
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID DELETE"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; classtype:web-application-attack; sid:2006156; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial
Suricata
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2006-6802 [HIGH] ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID INSERT
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID INSERT"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; classtype:web-application-attack; sid:2006155; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial
Suricata
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2006-6802 [HIGH] ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID ASCII
ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID ASCII"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; classtype:web-application-attack; sid:2006157; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial
No public exploits indexed.
Bugzilla
CVE-2020-6802 python-bleach: mutation XSS vulnerability
bugzilla·2020-04-21·CVSS 6.1
CVE-2020-6802 [MEDIUM] CVE-2020-6802 python-bleach: mutation XSS vulnerability
CVE-2020-6802 python-bleach: mutation XSS vulnerability
Calls to ``bleach.clean`` allowing ``noscript`` and one or more of the raw text tags (``title``, ``textarea``, ``script``, ``style``, ``noembed``, ``noframes``, ``iframe``, and ``xmp``) were vulnerable to a mutation XSS.
Reference:
https://bugzilla.mozilla.org/show_bug.cgi?id=1615315
Discussion:
Created python-bleach tracking bugs for this issue:
Affects: epel-all [bug 1826276]
Affects: fedora-all [bug 1826275]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
Bugzilla
CVE-2020-6802 python-bleach: mutation XSS vulnerability [epel-all]
bugzilla·2020-04-21·CVSS 6.1
CVE-2020-6802 [MEDIUM] CVE-2020-6802 python-bleach: mutation XSS vulnerability [epel-all]
CVE-2020-6802 python-bleach: mutation XSS vulnerability [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EP
Bugzilla
CVE-2020-6802 python-bleach: mutation XSS vulnerability [fedora-all]
bugzilla·2020-04-21·CVSS 6.1
CVE-2020-6802 [MEDIUM] CVE-2020-6802 python-bleach: mutation XSS vulnerability [fedora-all]
CVE-2020-6802 python-bleach: mutation XSS vulnerability [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedor
https://advisory.checkmarx.net/advisory/CX-2020-4276https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5rhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72R4VFFHDRSQMNT7IZU3X2755ZP4HGNI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCNLM2MGQTOLCIVVYS2Z5S7KOQJR5JC4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTULPQB7HVPPYWEYVNHJGDTSPVIDHIZX/https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleachhttps://advisory.checkmarx.net/advisory/CX-2020-4276https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5rhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72R4VFFHDRSQMNT7IZU3X2755ZP4HGNI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCNLM2MGQTOLCIVVYS2Z5S7KOQJR5JC4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTULPQB7HVPPYWEYVNHJGDTSPVIDHIZX/https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach
2020-03-24
Published