PT-2023-3322 · Go+10 · Go+10

Juho Nurminen

·

Publicado

2023-04-20

·

Atualizado

2024-12-13

·

CVE-2023-29400

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Go versions (affected versions not specified)
Description The issue arises from templates containing actions in unquoted HTML attributes, such as "attr={{.}}", which can be executed with empty input, resulting in output with unexpected results when parsed due to HTML normalization rules. This may allow the injection of arbitrary attributes into tags. The vulnerability can be exploited by a remote attacker.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Special Elements Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94CWE-74

Identificadores relacionados

ALSA-2023:6346
ALSA-2023:6363
ALSA-2023:6402
ALSA-2023:6473
ALSA-2023:6474
ALSA-2023:6938
ALSA-2023:6939
ALT-PU-2023-1699
ALT-PU-2023-1734
ALT-PU-2023-4736
ALT-PU-2023-4785
ALT-PU-2023-5492
ALT-PU-2023-7055
AZL-26615
AZL-26627
AZL-34749
AZL-37470
AZL-37500
AZL-79022
BDU:2023-03472
BIT-GOLANG-2023-29400
CESA-2023_3319
CESA-2023_6938
CESA-2023_6939
CVE-2023-29400
GO-2023-1753
MGASA-2023-0169
OESA-2023-1294
OPENSUSE-SU-2024:12907-1
OPENSUSE-SU-2024:12908-1
RHSA-2023:3318
RHSA-2023:3319
RHSA-2023:3323
RHSA-2023:3366
RHSA-2023:3445
RHSA-2023:3540
RHSA-2023:4003
RHSA-2023:4093
RHSA-2023:4459
RHSA-2023:4470
RHSA-2023:6346
RHSA-2023:6363
RHSA-2023:6402
RHSA-2023:6473
RHSA-2023:6474
RHSA-2023:6938
RHSA-2023:6939
RHSA-2023_3318
RHSA-2023_3319
RHSA-2023_6346
RHSA-2023_6363
RHSA-2023_6402
RHSA-2023_6473
RHSA-2023_6474
RHSA-2023_6938
RHSA-2023_6939
SUSE-SU-2023:2105-1
SUSE-SU-2023:2105-2
SUSE-SU-2023:2127-1
USN-6140-1

Produtos afetados

Alt Linux
Almalinux
Astra Linux
Centos
Debian
Go
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu