CVE-2023-2142
Nunjucks autoescape bypass leads to cross site scripting
Résumé
Nunjucks autoescape bypass leads to cross site scripting
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Nunjucks versions prior to version 3.2.4, it was
possible to bypass the restrictions which are provided by the autoescape
functionality. If there are two user-controlled parameters on the same
line used in the views, it was possible to inject cross site scripting
payloads using the backslash \ character.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-2142 node-nunjucks
- Ubuntu UBUNTU-CVE-2023-2142 node-nunjucks
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- report bugzilla.mozilla.org