PT-2021-3417 · Striptags · Striptags

Erik-Krogh · Published 2021-06-18 · Updated 2021-06-24 · CVE-2021-32696

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions striptags versions prior to 3.2.0

Description A type-confusion issue can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be exploited by an attacker who can control the input shape, for example, if query parameters are directly passed into the function, leading to cross-site scripting (XSS) attacks.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 to resolve the issue. As a temporary workaround, ensure that the html parameter is a string before calling the function.

Fix

Type Confusion

XSS

Weakness Enumeration

CWE-241

CWE-843

CWE-79

Related Identifiers

BDU:2021-03269

CVE-2021-32696

GHSA-QXG5-2QFF-P49R

Affected Products

Striptags

References · 10

• https://github.com/ericnorris/striptags/commit/f252a6b0819499cd65403707ebaf5cc925f2faca · Patch
• https://osv.dev/vulnerability/GHSA-qxg5-2qff-p49r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32696 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03269 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32696 · Security Note
• https://github.com/ericnorris/striptags/releases/tag/v3.2.0 · Note
• https://github.com/ericnorris/striptags/security/advisories/GHSA-qxg5-2qff-p49r · Note
• https://npmjs.com/package/striptags · Note
• https://t.me/cvenotify/16555 · Telegram Post
• https://vuldb.com/?id.177233 · Note