PT-2014-1801 · Lxml+2 · Lxml+2
Максим Кочкин
·
Publicado
2014-05-14
·
Atualizado
2025-12-18
·
CVE-2014-3146
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
lxml versions prior to 3.3.5
Description
The issue is related to an incomplete blacklist vulnerability in the
lxml.html.clean module, which allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean html function. This can lead to a violation of the integrity of protected information. The exploitation of this vulnerability can be carried out remotely.Recommendations
For versions prior to 3.3.5, update to version 3.3.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
lxml.html.clean module until a patch is available. Avoid using the clean html function in the affected module to minimize the risk of exploitation.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Suse
Ubuntu
Lxml