CVE-2023-24539 — Injection in Standard Library Html Template

CWE-74 — InjectionCWE-94 — Code InjectionCWE-176 — Improper Handling of Unicode Encoding9 documents8 sources
Severity
7.3HIGHNVD
EPSS
0.1%
top 79.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GO Standard Library Html TemplateGolang GO
Timeline
PublishedMay 11
Latest updateJun 6

Description

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶CVEListV5go_standard_library/html_template1.20.0-0 — 1.20.4+1
▶NVDgolang/go1.20.0 — 1.20.4+1

Patches

Patch: go.dev ↗Patch: go.dev ↗Patch: go.dev ↗

🔴Vulnerability Details

4
CVEList
Improper sanitization of CSS values in html/template↗2023-05-11
▶
GHSA
GHSA-3q6h-q44p-xw88: Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts↗2023-05-11
▶
OSV
CVE-2023-24539: Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts↗2023-05-11
▶
OSV
Improper sanitization of CSS values in html/template↗2023-05-05
▶

📋Vendor Advisories

4
Ubuntu
Go vulnerabilities↗2023-06-06
▶
Microsoft
Improper sanitization of CSS values in html/template↗2023-05-09
▶
Red Hat
golang: html/template: improper sanitization of CSS values↗2023-04-20
▶
Debian
CVE-2023-24539: golang-1.15 - Angle brackets (<>) are not considered dangerous characters when inserted into C...↗2023
▶
CVE-2023-24539 — Injection | cvebase