logo

Database

Reflected cross-site scripting (XSS) In lxml

Description

lxml Cross-site Scripting Via Control Characters Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2014-31462. NVD-2014-31463. OSV-2014-31464. OSV-DEBIAN-2014-31465. GCVE-2014-31466. SECURITY-TRACKER-CVE-2014-31467. bugzilla.redhat.com

References

1. https://github.com/lxml/lxml/pull/2732. https://github.com/lxml/lxml/commit/3f3082e0a67851cde26a48da3d1f4b75d8aa07ec3. https://github.com/lxml/lxml/commit/86e81ab393ba14c1be71284675851a3bdce57d694. https://github.com/lxml/lxml/commit/e86b294f1f81b899a59925123560ff924a72f1cc5. https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2014-9.yaml6. https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html7. https://web.archive.org/web/20141017122607/https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html8. https://web.archive.org/web/20150523055039/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:112/?name=MDVSA-2015:1129. https://web.archive.org/web/20200228180542/http://www.securityfocus.com/bid/6715910. http://advisories.mageia.org/MGASA-2014-0218.html11. http://lists.opensuse.org/opensuse-updates/2014-05/msg00083.html12. http://lxml.de/3.3/changes-3.3.5.html13. http://seclists.org/fulldisclosure/2014/Apr/21014. http://seclists.org/fulldisclosure/2014/Apr/31915. http://www.debian.org/security/2014/dsa-294116. http://www.openwall.com/lists/oss-security/2014/05/09/717. http://www.ubuntu.com/usn/USN-2217-118. https://www.exploit-db.com/exploits/3915519. https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007129.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.