PT-2021-18157 · Unknown · Bluemonday

Ryotak · Published 2021-03-27 · Updated 2021-06-04 · CVE-2021-29272

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: bluemonday versions prior to 1.0.5

Description: The issue allows for XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the script string. This can bypass a protection mechanism against user-inputted HTML elements such as the script tag.

Recommendations: For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the input of Cyrillic characters or disabling the use of the script tag until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-29272

GHSA-3X58-XR87-2FCJ

GO-2022-0762

Affected Products

Bluemonday

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2021-29272 · Security Note
• https://osv.dev/vulnerability/GHSA-3x58-xr87-2fcj · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29272 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29272 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0762 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29272 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-29272 · Security Note
• https://github.com/microcosm-cc/bluemonday/releases/tag/v1.0.5 · Note
• https://github.com/microcosm-cc/bluemonday/issues/111 · Note
• https://github.com/microcosm-cc/bluemonday · Note
• https://github.com/microcosm-cc/bluemonday/commit/524f142fe46e945b7dcd291d7805c4b7dcf75bee · Note
• https://t.me/cvenotify/12166 · Telegram Post
• https://vuln.ryotak.me/advisories/4.txt · Note
• https://pkg.go.dev/vuln/GO-2022-0762 · Note
• https://vuln.ryotak.me/advisories/4 · Note