CVE-2023-2142
Nunjucks autoescape bypass leads to cross site scripting
概要
Nunjucks autoescape bypass leads to cross site scripting
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In Nunjucks versions prior to version 3.2.4, it was
possible to bypass the restrictions which are provided by the autoescape
functionality. If there are two user-controlled parameters on the same
line used in the views, it was possible to inject cross site scripting
payloads using the backslash \ character.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-2142 node-nunjucks
- Ubuntu UBUNTU-CVE-2023-2142 node-nunjucks
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- report bugzilla.mozilla.org